Snort mailing list archives
Re: Preproc tuning
From: snort user <snort.user () gmail com>
Date: Fri, 17 Jun 2005 16:21:37 -0400
In both cases, it does exactly the same thing in the code. and this happens when snort starts. so i dont understand if there is a performance difference. might be something else that is causing the performance difference On 6/17/05, Joel Esler <eslerj () gmail com> wrote:
I know what it does. What I am saying is, if you specify them in the .conf file, as opposed to letting the compiled code do it, is it faster? In my tests it's showing significant CPU performance increase.. J On 6/17/05, snort user <snort.user () gmail com> wrote:Those are the default ports for which state tracking/reassembly is done if you dont specify anything in the snort.conf # ports [list] - use the space separated list of ports in [list], "all" # will turn on reassembly for all ports, "default" will turn # on reassembly for ports 21, 23, 25, 53, 80, 143, 110, 111 # and 513 On 6/17/05, Joel Esler <eslerj () gmail com> wrote:Has anyone else noticed a significant performance increase by specifying the ports for stream4? If I look at the code for stream 4, take the ports that are in there. and specify them via the snort.conf ports: < 21 23 25 53 42 80 110 111 143 513 >....etc.. It is SO much faster and doesn't consume as much CPU resources... anyone? ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&opclick _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?listsnort-users
------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Preproc tuning Joel Esler (Jun 17)
- Re: Preproc tuning snort user (Jun 17)
- Re: Preproc tuning Joel Esler (Jun 17)
- Re: Preproc tuning snort user (Jun 17)
- Re: Preproc tuning Joel Esler (Jun 17)
- Re: Preproc tuning Mohamed Eldesoky (Jun 19)
- Re: Preproc tuning Joel Esler (Jun 17)
- Re: Preproc tuning snort user (Jun 17)