Re: Poor bandwidth using snort 2.9.0.4 in afpacket mode

[Russ Combs <rcombs () sourcefire com>]

On Tue, Apr 5, 2011 at 3:05 PM, carlopmart <carlopmart () gmail com> wrote:

> On 04/05/2011 08:32 PM, Russ Combs wrote:
> > You could try commenting out the normalize_* to see if it is doing
> > anything your traffic doesn't tolerate very well.
>
> Perfect!! .. But why?? I don't understand because normalize_* configs
> are supposed to work inline mode, no?

You mean disabling normalize_* brought your throughput up to what you
expected?  You could try disabling just one at a time to narrow it down.

Yes, normalization only applies to inline.  We have some tweaks for that
coming out in the next release but really you'd need to capture some packets
to see exactly what the issue is.


> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
>
>
> ------------------------------------------------------------------------------
> Xperia(TM) PLAY
> It's a major breakthrough. An authentic gaming
> smartphone on the nation's most reliable network.
> And it wants your games.
> http://p.sf.net/sfu/verizon-sfdev
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
Xperia(TM) PLAY
It's a major breakthrough. An authentic gaming
smartphone on the nation's most reliable network.
And it wants your games.
http://p.sf.net/sfu/verizon-sfdev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users