[Snort-devel] High CPU Utilization

Victor Barahona victor.barahona at ...463...
Thu Jun 14 12:32:15 EDT 2001


I'm running snort (1.8beta24) and analizing a line with 15-20 Mb/s, hardware 
is a PIII 256Mb with linux and running mysql and acid, oficial rules from 

Fist time I run snort the CPU go to 95% but after some probes I notice that 
when I comented the http rules the cpu came to 35%-40. After some probes 
more, I notice that when in the configuracion file was:

var HTTP_SERVERS [xxx.yyy.9.8,xxx.yyy.9.237,xxx.yyy.30.2]

The analice was CPU intensive 95% but when I chage to this:

var HTTP_SERVERS [xxx.yyy.0.0/16]

The CPU back to 40%

The question: Is this a bug or just a normal issue?

Maybe this have relation with other messages about CPU usage I have seen 
before in this list, I don't know.


"Alone? you are not alone, Bigbrother is watching you"

Victor Barahona Cabezon
http://rincon.uam.es/dir?cw=870938110351562	       PGP ID-0x8750AB79
Soporte Seguridad en red........................http://www.utc.uam.es/ss

More information about the Snort-devel mailing list