[Snort-users] improving performance of the defrag module

Bill Marquette wlmarque at ...8...
Fri Jan 19 10:54:36 EST 2001



> When I use the defrag module, it maxes out the CPU on a PIII 733 when I'm
> sniffing a 25Mb/sec link.  I was looking at the source, and I found this:
>
> #define FRAGTIMEOUTSEC      10      /* 10 seconds let's play safe for now */
> #define FRAGTIMEOUTUSEC      0      /* 0 micro seconds                  */
> #define FASTSWEEPLIM      16000000      /* memory use threhold for fast
> sweep */
>
>
> If I reduce the FRAGTIMEOUTSEC from 10 down to something like 2, won't the
> keep the size of the splay tree smaller and reduce search times?  Will
> either of the other 2 settings do anything useful for me?



More information about the Snort-users mailing list