Snort mailing list archives
Re: Network cards for IPS & query related to PFRING
From: Anshuman Anil Deshmukh <anshuman () cybage com>
Date: Thu, 24 Oct 2013 09:35:43 +0000
Thanks Peter for the confirmation. Just to let you know that I already have the performance statistics enabled and these stats are visible in graphs using ZABBIX. With that I am already able to see the amount of traffic I am dropping. Thanks and Regards, Anshuman -----Original Message----- From: Peter Bates [mailto:peter.bates () ucl ac uk] Sent: Thursday, October 24, 2013 2:54 PM To: snort-users () lists sourceforge net Subject: Re: [Snort-users] Network cards for IPS & query related to PFRING -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all On 24/10/2013 08:06, Anshuman Anil Deshmukh wrote:
This is a follow-up email for my query. I have still not received an answer to my query related to PFRING. See my initial mail below.
For the amount of traffic you're talking about (max 100Mbps) you shouldn't need to use PF_RING. Load does vary though depending on your traffic profile and the number of rules you're running. It is worth enabling the performance statistics: preprocessor perfmonitor: time 300 file snort.stats pktcnt 10000 in your snort.conf will log stats to /var/log/snort/snort.stats and you can then see the amount of traffic you're dropping. Similarly when you stop Snort, you'll get some statistics: egrep '(Analyzed|Dropped):.*%' /var/log/syslog (or daemon.log depending on your distribution) There are a few suggestions in the Security Onion wiki: http://code.google.com/p/security-onion/wiki/Hardware and http://www.metaflows.com/solutions2/pf-ring/ - -- Peter Bates Senior Information Security Officer Phone: +44(0)2076792049 Information Services Division Internal Ext: 32049 University College London London WC1E 6BT -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSaOdJAAoJELhVoVpEMS6RywMH/A3kt/vz76zih4J/tTZyZ+HH Q42UIiIMO3b9sbTEQEhjozXqtyVIDJ0aoY9TpqSnGpP+Ba09ImSc+yP7Rxl5rAnP 8e7xwPB8kv5KDHzXCzWyTX29v/MbLGeibAHaQKjWpr2YWB+uc+FaFolLW/l0wYxU 3CkE9OF217KmVaU4D6WpPORWCKHT38mQfrzUPfSQJ98ZQ1JYPfFDgAVDYo301CAV ocTD3WSFWpojWmjASjyEPluFebwu5Ha5/0WeHJQsAkwrVnVD02qj7MQqL3aBlyBk VGB1bzg13VsahTfZuiWCYyVwVJp/JwuyI/vWPjbWy+0OhnmMwxepidHdcY5Q+l8= =x1BK -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! "Legal Disclaimer: This electronic message and all contents contain information from Cybage Software Private Limited which may be privileged, confidential, or otherwise protected from disclosure. The information is intended to be for the addressee(s) only. If you are not an addressee, any disclosure, copy, distribution, or use of the contents of this message is strictly prohibited. If you have received this electronic message in error please notify the sender by reply e-mail to and destroy the original message and all copies. Cybage has taken every reasonable precaution to minimize the risk of malicious content in the mail, but is not liable for any damage you may sustain as a result of any malicious content in this e-mail. You should carry out your own malicious content checks before opening the e-mail or attachment." www.cybage.com ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 17)
- Re: Network cards for IPS & query related to PFRING Mark W. Jeanmougin (Oct 26)
- <Possible follow-ups>
- Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 20)
- Message not available
- Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 21)
- Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 24)
- Re: Network cards for IPS & query related to PFRING Peter Bates (Oct 24)
- Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Oct 24)
- Message not available