[Snort-users] snort optimization

Martin Roesch roesch at ...421...
Thu Jan 18 23:54:43 EST 2001


No, that's the minfrag preprocessor.  The defrag preprocessor performs
IP defragmentation and looks like this in the snort.conf file:

preprocessor defrag

   -Marty


Kevin.Brown at ...1022... wrote:
> 
> I don't want to assume anything, so by defrag preprocessor do you mean
> preprocessor minfrag: 128?
> 
> > Try commenting out the defrag preprocessor, If I disable mine, I go from
> > 99.9% cpu to about 20 or 30%.  Of course, you don't get alerted to some
> > things that way.
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users

--
Martin Roesch
roesch at ...421...
http://www.snort.org




More information about the Snort-users mailing list