Re: Acceptable packet loss?

[Joel Esler <eslerj () gmail com>]

Being in a high-optempo environment such as I am.  I judge 0% to be
acceptable.  With a max of about 3%.  But I haven't had any packet
loss in over a year.  (On a box running a 1.6 GHZ with 256Ms of RAM,
on a rather large circuit.. It has alot to do with rule tuning and
output module as well..)

On 5/23/05, Matt Kettler <mkettler () evi-inc com> wrote:
> Byron Pezan wrote:
> > What do most of you consider to acceptable packet loss?
> >
> > I am running snort 2.1 on some fairly low end hardware and have tuned
> > the box using some suggestions from Mark Kettler in one of his earlier
> > posts to the list
> > (http://marc.theaimsgroup.com/?l=snort-users&m=105586643024094&w=2).  I
> > am seeing about 4% packet loss on this sensor during my (un-scientific)
> > testing.  Would you consider that acceptable or should I look into
> > further tuning?
>
> My name is Matt, not Mark :)
>
> That aside, really what level of packet loss is acceptable depends a lot on what
> your security goals are.
>
> To a person operating a high-threat, high-security network, any packet loss is
> completely unacceptable, as it means an attack could be missed. A sophisticated
> attacker may try to intentionally load down the IDS with a bogus alarm that is
> likely to be ignored just fractions of a second before the real attack.
>
> If your goals with snort are just to increase your security awareness a bit,
> then some packet loss may be acceptable to you.
>
> So, I guess you could boil it down this way:
>
>
> Are you concerned with detecting sophisticated attackers who try to use noise to
> evade IDS detection. If so, you need 0% loss.
>
> If you aren't concerned with the evasive attacks, what percentage of ordinary
> attacks are you willing to accept not knowing about? Your packet loss rate
> should definitely be less than this number.
>
> As a rule-of-thumb I might suggest trying to keep your packet loss at less than
> half your accepted miss rate.
>
> I'll admit that "factor of one half" is largely a gut-instinct number and has no
> measured basis. However, it is definitely true that the impact of a packet loss
> can be much greater than missing one packet worth of data when you start
> considering that stream4 can get confused about the connection state,
> particularly if it misses a syn packet. Weighing that back and forth with how
> few packets are syn packets leads me to feel that somewhere between 3/4 and 1/4
> would be about the right weighting factor. As this is a very inexact guess I
> certainly invite you to think about this yourself and come to your own conclusions.
>
>
>
>
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-- 
Joel Esler
BASE Project Lead
http://sourceforge.net/projects/secureideas


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_idt12&alloc_id344&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users