[Snort-devel] Snort Inline performance question

Terry Vernon tvernon24 at ...2251...
Wed May 11 14:29:41 EDT 2005


What I'm asking is, would it be faster to use unified logging and pipe 
it to a third party application to create an IPS or use snort_inline. I 
want to know how much slower snort runs when in inline mode than in 
unified logging mode, doesn't matter that they serve different 
functions, I just need to know what's the overhead and which drops less 
packets on extremely large and fast networks.

Thanks
Terry Vernon





William Metcalf wrote:

> Errrr they serve different functions, so not sure what your asking here.
>
> Regards,
>
> Will
> Inactive hide details for Terry Vernon <tvernon24 at ...2251...>Terry 
> Vernon <tvernon24 at ...2251...>
>
>
>                         *Terry Vernon <tvernon24 at ...2251...>*
>                         Sent by: snort-devel-admin at lists.sourceforge.net
>
>                         05/11/2005 12:45 PM
>
> 	
>
> To
> 	
> snort-devel at lists.sourceforge.net
>
> cc
> 	
>
> Subject
> 	
> [Snort-devel] Snort Inline performance question
>
> 	
>
>
> What would be the performance difference between running snort in
> unified logging mode and running it it inline mode?
>
> Thanks
> Terry Vernon
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click 
> <http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click>
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>





More information about the Snort-devel mailing list