Snort mailing list archives
Re: Network cards for IPS & query related to PFRING
From: Peter Bates <peter.bates () ucl ac uk>
Date: Thu, 24 Oct 2013 10:24:26 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all On 24/10/2013 08:06, Anshuman Anil Deshmukh wrote:
This is a follow-up email for my query. I have still not received an answer to my query related to PFRING. See my initial mail below.
For the amount of traffic you're talking about (max 100Mbps) you shouldn't need to use PF_RING. Load does vary though depending on your traffic profile and the number of rules you're running. It is worth enabling the performance statistics: preprocessor perfmonitor: time 300 file snort.stats pktcnt 10000 in your snort.conf will log stats to /var/log/snort/snort.stats and you can then see the amount of traffic you're dropping. Similarly when you stop Snort, you'll get some statistics: egrep '(Analyzed|Dropped):.*%' /var/log/syslog (or daemon.log depending on your distribution) There are a few suggestions in the Security Onion wiki: http://code.google.com/p/security-onion/wiki/Hardware and http://www.metaflows.com/solutions2/pf-ring/ - -- Peter Bates Senior Information Security Officer Phone: +44(0)2076792049 Information Services Division Internal Ext: 32049 University College London London WC1E 6BT -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSaOdJAAoJELhVoVpEMS6RywMH/A3kt/vz76zih4J/tTZyZ+HH Q42UIiIMO3b9sbTEQEhjozXqtyVIDJ0aoY9TpqSnGpP+Ba09ImSc+yP7Rxl5rAnP 8e7xwPB8kv5KDHzXCzWyTX29v/MbLGeibAHaQKjWpr2YWB+uc+FaFolLW/l0wYxU 3CkE9OF217KmVaU4D6WpPORWCKHT38mQfrzUPfSQJ98ZQ1JYPfFDgAVDYo301CAV ocTD3WSFWpojWmjASjyEPluFebwu5Ha5/0WeHJQsAkwrVnVD02qj7MQqL3aBlyBk VGB1bzg13VsahTfZuiWCYyVwVJp/JwuyI/vWPjbWy+0OhnmMwxepidHdcY5Q+l8= =x1BK -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 17)
- Re: Network cards for IPS & query related to PFRING Mark W. Jeanmougin (Oct 26)
- <Possible follow-ups>
- Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 20)
- Message not available
- Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 21)
- Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 24)
- Re: Network cards for IPS & query related to PFRING Peter Bates (Oct 24)
- Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 24)
- Message not available