[Snort-users] snort optimization

Kevin.Brown at ...1022... Kevin.Brown at ...1022...
Fri Jan 19 12:17:04 EST 2001


If that's the case then it's not in the config file I have.

> No, that's the minfrag preprocessor.  The defrag preprocessor performs
> IP defragmentation and looks like this in the snort.conf file:
> 
> preprocessor defrag

> > I don't want to assume anything, so by defrag preprocessor do you mean
> > preprocessor minfrag: 128?

> > > Try commenting out the defrag preprocessor, If I disable mine, I go from
> > > 99.9% cpu to about 20 or 30%.  Of course, you don't get alerted to some
> > > things that way.





More information about the Snort-users mailing list