Re: Poor performance using snort 2.8.x in inline mode

[Jim McCullough <jim.mccullough () gmail com>]

part of the problem is going to be utilization of the the chipset.  your bus
can only have so much through put without some serious tweaking.   I would
recommend a slimmer base OS kernel to start if you expect that type of
performance from snort with that hardware.  second is that you should not
expect gigabit performance abilities.  part of the bottle neck is going to
be memory speed and memory utilization speed.

   A default RHEL build with VMWare ESX, and a client default RHEL will not
produce the performance your looking for even if you were using an ICH8
southbridge, and 975G north bridge performing at 1066mhz.  plus utilizing
8GB of 1066mhz DDR2 ram on a quad core 3ghz processor running at 1066 for
the FSB.

Kernel customization for the specific hardware would be required to speed
things up to start.

On Wed, Jan 21, 2009 at 6:24 AM, carlopmart <carlopmart () gmail com> wrote:

> Edward Bjarte Fjellskål wrote:
> > carlopmart wrote:
> >
> > > lspci -v
> > > 00:00.0 Host bridge: Intel Corporation 440BX/ZX/DX - 82443BX/ZX/DX Host
> bridge
> > > (rev 01)
> > >          Subsystem: VMware Inc Virtual Machine Chipset
> > >          Flags: bus master, medium devsel, latency 0
> >
> > > 00:13.0 Ethernet controller: Intel Corporation 82545EM Gigabit Ethernet
> > > Controller (Copper) (rev 01)
> > >          Subsystem: VMware Inc Abstract PRO/1000 MT Single Port Adapter
> > >          Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 193
> > >          Memory at f4880000 (64-bit, non-prefetchable) [size=128K]
> > >          Memory at f4820000 (64-bit, non-prefetchable) [size=64K]
> > >          I/O ports at 1480 [size=64]
> > >          [virtual] Expansion ROM at 30020000 [disabled] [size=64K]
> > >          Capabilities: [dc] Power Management version 2
> > >          Capabilities: [e4] PCI-X non-bridge device
> >
> > VMware...
> >
> > Other VMs running ?
> > Total overview of the system resources usages ?
>
> Correct, I am running this snort inline under vmware ESXi. ESXi staticis
> are:
>
>  Memory Total: 5GB RAM
>  Memory Used: 3.2 GB
>  CPU usage: 240 MHz (Server it is Dual Core 2GHz)
>
>  .. and I not using resource pools ...
> > E
>
>
> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by:
> SourcForge Community
> SourceForge wants to tell your story.
> http://p.sf.net/sfu/sf-spreadtheword
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users