Snort mailing list archives
Re: Only TCP packets towards the Snort host trigger alerts
From: James Lay <jlay () slave-tothe-box net>
Date: Tue, 13 Nov 2012 08:51:54 -0700
On 2012-11-13 08:37, Rennhard Marc (rema) wrote:
This solved it, thanks. It worked without this option with Snort 2.8.5 / Ubuntu 11.04 - it appears Ubuntu has recently enabled checksum offloading. Cheers, Marc
I added the below to my startup scripts for Ubuntu: ethtool -K eth0 rx off ethtool -K eth0 tx off ethtool -K eth0 sg off ethtool -K eth0 tso off ethtool -K eth0 gso off ethtool -K eth0 gro off This has helped tremendously. James ------------------------------------------------------------------------------ Monitor your physical, virtual and cloud infrastructure from a single web console. Get in-depth insight into apps, servers, databases, vmware, SAP, cloud infrastructure, etc. Download 30-day Free Trial. Pricing starts from $795 for 25 servers or applications! http://p.sf.net/sfu/zoho_dev2dev_nov _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Only TCP packets towards the Snort host trigger alerts Rennhard Marc (rema) (Nov 13)
- Re: Only TCP packets towards the Snort host trigger alerts JJC (Nov 13)
- Re: Only TCP packets towards the Snort host trigger alerts Rennhard Marc (rema) (Nov 13)
- Re: Only TCP packets towards the Snort host trigger alerts James Lay (Nov 13)
- Re: Only TCP packets towards the Snort host trigger alerts Doug Burks (Nov 13)
- Re: Only TCP packets towards the Snort host trigger alerts Rennhard Marc (rema) (Nov 13)
- Re: Only TCP packets towards the Snort host trigger alerts JJC (Nov 13)