[Snort-devel] snort option [-n packet-count ]

ratheesh kannoth ratheesh.ksz at ...2499...
Thu May 22 23:43:10 EDT 2014


On Thu, May 22, 2014 at 7:55 PM, Steve Sturges (ststurge)
<ststurge at ...3461...> wrote:

> Yes, one packet at a time.
> Once snort is finished with a packet, it returns from callback to the daq module and waits for next packet.

SourceFire production systems also uses same design ?. It looks like
one packet at a time wont give much performance


> That is up to the daq module... Basically If inline, that is the id (arbitrary per daq module) of the interface where packets are sent out.  If passive, it isn't set.
>>
Could you pls explain a little bit more  here ? Even if we configure
it as inline , verdict is made for each packet . So we know from where
the packet has come and where it has to go. ?
I agree that if  packet  is  put into DAQ layer using daq_reinject
routine (by snort ) , may be we dont have those ( egress and ingress
interface info ). I am not very sure on this statement ?


>> -Ratheesh
>>
>> ------------------------------------------------------------------------------
>> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
>> Instantly run your Selenium tests across 300+ browser/OS combos.
>> Get unparalleled scalability from the best Selenium testing platform available
>> Simple to use. Nothing to install. Get started now for free."
>> http://p.sf.net/sfu/SauceLabs
>> _______________________________________________
>> Snort-devel mailing list
>> Snort-devel at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-devel
>> Archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>>
>> Please visit http://blog.snort.org for the latest news about Snort!




More information about the Snort-devel mailing list