Snort mailing list archives
Re: Snort not seeing all packets
From: Matt Kettler <mkettler () evi-inc com>
Date: Tue, 22 Feb 2005 15:38:57 -0500
At 02:45 PM 2/22/2005, sEc nErD wrote:
I seem to have a strange problem on one of the interfaces snort is not seeing all packets..like when i run tcp dump and run a port scan towards that sniffing interface i don't see it in the tcpdump also when i ctrl-c tcpdump it shows me large amounts of packets dropped by kernel compared to recieved in filter like almost 85% dropped.
Clearly your system isn't able to keep up. A few questions that might help you find some solutions:
1) What kind of data rate are we talking here? gigabit? 100m?2) What kind of pcap library are you using? Are you using phil wood's enhanced pcap library?
3) what kind of network card are you using (this does matter.. some like the realtek 8129 are very inefficient in terms of CPU load).
4) What kind of CPU are you running on? ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- AW: BASE performance Lieker Heinrich (Feb 22)
- Re: AW: BASE performance James Riden (Feb 22)
- Snort not seeing all packets sEc nErD (Feb 22)
- Re: Snort not seeing all packets Matt Kettler (Feb 22)
- Snort not seeing all packets sEc nErD (Feb 22)
- Re: AW: BASE performance James Riden (Feb 22)