[Snort-users] improving performance of the defrag module
wlmarque at ...8...
Fri Jan 19 10:54:36 EST 2001
> When I use the defrag module, it maxes out the CPU on a PIII 733 when I'm
> sniffing a 25Mb/sec link. I was looking at the source, and I found this:
> #define FRAGTIMEOUTSEC 10 /* 10 seconds let's play safe for now */
> #define FRAGTIMEOUTUSEC 0 /* 0 micro seconds */
> #define FASTSWEEPLIM 16000000 /* memory use threhold for fast
> sweep */
> If I reduce the FRAGTIMEOUTSEC from 10 down to something like 2, won't the
> keep the size of the splay tree smaller and reduce search times? Will
> either of the other 2 settings do anything useful for me?
More information about the Snort-users