Snort mailing list archives

Is there an acceptable amount of dropped packets for snort?


From: Andy Berryman <aberryman () cymtec com>
Date: Mon, 8 Feb 2010 12:55:07 -0800

Just wondering if there is a general acceptable amount of dropped packets for snort? Someone told me anything under 
around 10% would be acceptable. To me that's not right, any dropped packets to me is a big deal.

Would this be considered acceptable? My interval for the stats reporting is every 30 seconds.

Feb  8 19:30:32 (none) snort[25517]: Pkts Recv:   679621
Feb  8 19:30:32 (none) snort[25517]: Pkts Drop:   3096
Feb  8 19:30:32 (none) snort[25517]: % Dropped:   0.456%


  8 19:30:32 (none) snort[25517]: Mbits/Second
Feb  8 19:30:32 (none) snort[25517]: ----------------
Feb  8 19:30:32 (none) snort[25517]: Snort:       347.481
Feb  8 19:30:32 (none) snort[25517]: Sniffing:    1509.490
Feb  8 19:30:32 (none) snort[25517]: Combined:    282.460
Feb  8 19:30:32 (none) snort[25517]: uSeconds/Pkt
Feb  8 19:30:32 (none) snort[25517]: ----------------

Feb  8 19:30:32 (none) snort[25517]: Snort Setwise Event Stats
Feb  8 19:30:32 (none) snort[25517]: -------------------------
Feb  8 19:30:32 (none) snort[25517]: Total Events:           913852
Feb  8 19:30:32 (none) snort[25517]: Qualified Events:       451
Feb  8 19:30:32 (none) snort[25517]: Non-Qualified Events:   913401
Feb  8 19:30:32 (none) snort[25517]: %Qualified Events:      0.0494%
Feb  8 19:30:32 (none) snort[25517]: %Non-Qualified Events:  99.9506%

Thanks,
Andy Berryman

------------------------------------------------------------------------------
The Planet: dedicated and managed hosting, cloud storage, colocation
Stay online with enterprise data centers and the best network in the business
Choose flexible plans and management services without long-term contracts
Personal 24x7 support from experience hosting pros just a phone call away.
http://p.sf.net/sfu/theplanet-com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: