Snort mailing list archives
Re: snort dropping 48%
From: Matt Kettler <mkettler () evi-inc com>
Date: Wed, 28 Apr 2004 21:49:24 -0400
At 01:46 PM 4/28/2004, Sheahan, Paul wrote:
Now I've upgraded to a big beefy server, gig Ethernet, RH Linux 8.0 and Snort 2.0.5 using the same Snort config as above. Traffic levels are the same. Now I noticed it was dropping half of the traffic! My custom content rules are extremely important to me, so I performed a test. I created this bare bones snort.conf which basically disables all standard rules and extra preprocessors:
<snip>
Then I started Snort and let it capture traffic for a while. I stopped Snort and it is STILL dropping 48% of the traffic! My "my.rules" file contains a few hundred content-based rules. What gives? Can Snort no longer handle content-based rules? Or am I missing something here?
Is it possible your pcap library that came with RH 8.0 is borked or reporting bad statistics (it's been known to happen on RedHat)?
How does tcpdump perform on the same system? Does it drop packets too?
------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10gGet certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort dropping 48% Sheahan, Paul (Apr 28)
- Message not available
- Re: snort dropping 48% Matt Kettler (Apr 28)
- legit network-traffic generating tool? siddharth thakkar (Apr 28)
- Re: snort dropping 48% Matt Kettler (Apr 28)
- Message not available
- <Possible follow-ups>
- RE: snort dropping 48% Sheahan, Paul (May 06)
- Re: snort dropping 48% sgt_b (May 06)
- RE: snort dropping 48% Sheahan, Paul (May 06)
- Re: snort dropping 48% sgt_b (May 06)
- RE: snort dropping 48% Sheahan, Paul (May 06)
- RE: snort dropping 48% Frank Knobbe (May 06)
- Re: snort dropping 48% sgt_b (May 06)
- Re: snort dropping 48% Josh Berry (May 07)
- RE: snort dropping 48% Chuck Holley (May 07)