Snort mailing list archives

Re: Low Snort performances


From: Edin Dizdarevic <edin.dizdarevic () interActive-Systems de>
Date: Mon, 19 Apr 2004 11:24:29 +0200

Ciao!

Snort's "performance" mostly depends on how many rules you have
activated. After setting your ruleset you may try to tune other
parameters, using fast alerting, barnyard, giving your preprocessors
more memory etc. Also using a good supported NIC is important, as well
as some kernel parameters. Anyway, there are many discussions covering
this, so you may also find one or another hint in one of the older
postings.

Regards,
Edin

Gianluca Murgia schrieb:

Hi,

I'm using snort 2.1 with a Dual Intel P3 1266MHz 2GB RAM, OS Redhat 7.3 (
kernel 2.4.18-3smp ). I use it to monitor the traffic on a fddi token ring
network. The traffic can be up to 50MB/s and the network cards are
SysKonnect SK-5844 10/100 Mb/s.

The snort config file is set to reassemble the packets.

The maximum rate I can sniff without loss of packets is up to 4Mb/s. What's
the problem? Is there any kind of important setting on the machine that is
missing? On the other hand, which settings or services must not be running
on the machine in order to improve the performances?


Thanks, Luca


--
Edin Dizdarevic


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: