Snort mailing list archives
Re: Snort dropping packets. (fwd)
From: Matt Kettler <mkettler () evi-inc com>
Date: Sun, 14 Jul 2002 14:59:46 -0400
Ok, I'll take a stab at a response.Don't use the libpcap that is supplied by RedHat if you want numbers you can trust. From what I've read, they decided to change the libpcap interfaces a bit and broke some things along the way in the process of creating a "turbo" mode or something of the like. I recall a lot of grumbling on the list about this, and I think snort includes fixes for the redhat changes, but I wouldn't trust them to work 100% since a large number of people have observed the same problems as you and reported them to the snort list.
Try the official release of libpcap from tcpdump.org and see if you still have problems. (note that 0.6.2 is the latest versioned release)
At 04:25 PM 7/14/2002 +0200, Emilio Mira wrote:
I sent this mail few days ago, but I hadn't received any reply. It's about packets dropped by Snort. Anyone could give me a response?. Thank you. ---------- Forwarded message ---------- Date: Thu, 11 Jul 2002 12:10:20 +0200 (CEST) From: Emilio Mira <emial () alumni uv es> To: snort-users () lists sourceforge net Subject: Snort dropping packets. Hi all, I'm meassuring Snort dropped packets with 'kill -USR1 <pid>' and apparently Snort is working without drops. But if I get received packets by the interface from /proc/net/dev and processed packets from Snort with 'kill -USR1 <pid>', there are diferences (see JPG attached). Why doesn't USR1 shows me real dropped packets?. I'm using Snort 1.8.7 with default configuration and libpcap 0.7.1 on RH7.2. and an ATM interface. Thanks. -- Emilio Mira
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort dropping packets. (fwd) Emilio Mira (Jul 14)
- Re: Snort dropping packets. (fwd) Phil Wood (Jul 14)
- <Possible follow-ups>
- Re: Snort dropping packets. (fwd) Matt Kettler (Jul 14)
- Re: Snort dropping packets. Emilio Mira (Jul 14)
- Re: Snort dropping packets. Phil Wood (Jul 14)
- Re: Snort dropping packets. Emilio Mira (Jul 14)
- Re: Snort dropping packets. Emilio Mira (Jul 14)