Re: Snort inline afpaquet slow network

[Charlie Heselton <charles.heselton () gmail com>]

Apologize, for beginners, for bumping an old thread.  I'm experimenting
with inline snort and am seeing similar issues.  I'm unable to tell whether
it's hardware or something else.  I haven't tested the bridge yet, but that
is on the list of things to do.

Certain sites, especially those that load "stuff" (data, flash, etc.) in
the background seem to be most heavily affected.

Interestingly, the load on the interfaces/bridge (AFPacket "bridge") seems
to be relatively low.

On Mon, Sep 15, 2014 at 11:17 AM, Ezequiel M. Cardinali <
ezequiel.cardinali () donweb com> wrote:

>  Hi,
>
> I'm new to Snort,  I installed Snort inline mode for testing.
>
> The problem is when I try to download a file from a PC behind Snort I can
> only reach to 5kb/s while if I configure the bridge using brctl instead of
> Snort with afpacket, I can download at 200kb/s the same file.
>
> It's this normal?
> what could I've been doing wrong?
>
> I appreciate any idea to solve this problem
>
> Thanks!!
>
>
> --
>
>
>
> ------------------------------------------------------------------------------
> Want excitement?
> Manually upgrade your production database.
> When you want reliability, choose Perforce
> Perforce version control. Predictably reliable.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
Comprehensive Server Monitoring with Site24x7.
Monitor 10 servers for $9/Month.
Get alerted through email, SMS, voice calls or mobile push notifications.
Take corrective actions from your mobile device.
http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!