[Snort-devel] Compilation bug?

Shai Rubin shai at ...1503...
Mon May 23 12:03:45 EDT 2005


Hi there,

I'm trying to check how gcc-optimizations affect snort.
However, depending on the optimization flag I use I get different 
outputs (and not just performance change) from Snort (see description 
below).

It seems that with '-O2' the "TCP Stream Reassembly" section in the 
output reports less packets processed than with '-O1'.

I'm using the default configuration.

Anyone knows why this happens?


Thanks,

Shai Rubin


---------------------------------------------------------------
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Compiling with -O2
make clean
setenv CFLAGS "-g -O2 -Wall"
make -e

The output from snort:

          --== Initialization Complete ==--

    ,,_     -*> Snort! <*-
   o"  )~   Version 2.3.3 (Build 14)
    ''''    By Martin Roesch & The Snort Team: 
http://www.snort.org/team.html
            (C) Copyright 1998-2004 Sourcefire Inc., et al.

Run time for packet processing was 0.328 seconds


===============================================================================

Snort processed 16 packets.
===============================================================================
Breakdown by protocol:
     TCP: 16         (100.000%)
     UDP: 0          (0.000%)
    ICMP: 0          (0.000%)
     ARP: 0          (0.000%)
   EAPOL: 0          (0.000%)
    IPv6: 0          (0.000%)
     IPX: 0          (0.000%)
   OTHER: 0          (0.000%)
DISCARD: 0          (0.000%)
===============================================================================
Action Stats:
ALERTS: 0
LOGGED: 0
PASSED: 0
===============================================================================
TCP Stream Reassembly Stats:
     TCP Packets Used: 2          (12.500%)
     Stream Trackers: 1
     Stream flushes: 0
     Segments used: 0
     Stream4 Memory Faults: 0
===============================================================================
Final Flow Statistics
,----[ FLOWCACHE STATS ]----------
Memcap: 10485760 Overhead Bytes 16400 used(%0.158110)/blocks (16579/2) 
Overhead blocks: 1 Could Hold: (58579)
IPV4 count: 1 frees: 0 low_time: 1067225131, high_time: 1067225131, 
diff: 0h:00:00s
     finds: 2 reversed: 0(%0.000000)
     find_sucess: 1 find_fail: 1 percent_success: (%50.000000) new_flows: 1
  Protocol: 6 (%100.000000) finds: 2  reversed: 0(%0.000000)
   find_sucess: 1 find_fail: 1 percent_success: (%50.000000) new_flows: 1
Snort exiting



-----------------------------------------------------------------------------
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
The second case, compiling with -O1

make clean
setenv CFLAGS "-g -O1 -Wall"
make -e


         --== Initialization Complete ==--

    ,,_     -*> Snort! <*-
   o"  )~   Version 2.3.3 (Build 14)
    ''''    By Martin Roesch & The Snort Team: 
http://www.snort.org/team.html
            (C) Copyright 1998-2004 Sourcefire Inc., et al.

Run time for packet processing was 0.389 seconds


===============================================================================

Snort processed 16 packets.
===============================================================================
Breakdown by protocol:
     TCP: 16         (100.000%)
     UDP: 0          (0.000%)
    ICMP: 0          (0.000%)
     ARP: 0          (0.000%)
   EAPOL: 0          (0.000%)
    IPv6: 0          (0.000%)
     IPX: 0          (0.000%)
   OTHER: 0          (0.000%)
DISCARD: 0          (0.000%)
===============================================================================
Action Stats:
ALERTS: 0
LOGGED: 0
PASSED: 0
===============================================================================
TCP Stream Reassembly Stats:
     TCP Packets Used: 13         (81.250%) <--- different
     Stream Trackers: 1
     Stream flushes: 1
     Segments used: 1
     Stream4 Memory Faults: 0
===============================================================================
Final Flow Statistics
,----[ FLOWCACHE STATS ]----------
Memcap: 10485760 Overhead Bytes 16400 used(%0.158110)/blocks (16579/2) 
Overhead blocks: 1 Could Hold: (58579)
IPV4 count: 1 frees: 0 low_time: 1067225131, high_time: 1067225131, 
diff: 0h:00:00s
     finds: 14 reversed: 4(%28.571429)
     find_sucess: 13 find_fail: 1 percent_success: (%92.857143) new_flows: 1
  Protocol: 6 (%100.000000) finds: 14  reversed: 4(%28.571429)
   find_sucess: 13 find_fail: 1 percent_success: (%92.857143) new_flows: 1
Snort exiting





More information about the Snort-devel mailing list