Re: Snort + PF_RING + DAQ

[Peter Bates <peter.bates () ucl ac uk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello all

I'd actually be interested in anyone's Snort tuning suggestions
because I'm running Snort + PF_RING pretty much as per the Metaflows
10Gb instructions and still dropping traffic - this is with 1-2Gbps
and about 1000 rules.

Following the Metaflows route I was running 32 instances of Snort (and
32 x Barnyards) and the results were not encouraging.

And before Joel says it, I do know you have a SF box you could sell me ;)

- -- 
Peter Bates
Senior Computer Security Officer    Phone: +44(0)2076792049
Information Services Division       Internal Ext: 32049
University College London
London WC1E 6BT
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQEcBAEBAgAGBQJQRgzpAAoJELhVoVpEMS6RFq4IAJvw+PLuCrPr536b/eQgU63+
mcvsJLUVkt3cX9gMhqeWpolpCmqptgbqG9+hE52vvWmzuIQUC0YUEWeqsRa/hk46
lYL+QGJoUx+LmUFM3gMfCq84GQLwUd4NN2TRBsjPoUvze6YMFmOuAI5DlPCn2Jw9
bzZxQmNtufQyMI8jBefa/RsoU20gBgfKP3J7d5f8usOwRjJ9X/XmZ3eHoJn7bObg
cRk+sTJiaLijsWCDHWGrkN9dbED3b5tBofJvafZhAlCHIg+zGQtaeVxmRwZeNjAD
2EXwTSxka1hImKs+dtkvmTrvZHz8Wg+ktqBVbzcB7j24lDpl4jVJq+8XlKqXbB8=
=D/lX
-----END PGP SIGNATURE-----


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!