[Snort-devel] TCP Syn performance test

Jaime Nebrera jnebrera at ...2499...
Thu Jul 26 08:40:42 EDT 2012

   Hi all,

   We are trying to test the performance of Snort running as IPS using a 
TCP Syn Flood (sadly, dont have statefull tester right now)

   For sure Snort is not liking this kind of traffic (it didnt complain 
at all when done using UDP traffic) and some preprocessor is dropping 
the traffic, thus the generator believes is loosing traffic.

   May I ask what is the recommended procedure to configure Snort for 
such test? (of course, wont be a secure test, just performance wise)

   Thanks in advance. Regards

More information about the Snort-devel mailing list