[Snort-users] snort optimization

Martin Roesch roesch at ...421...
Sat Jan 27 02:04:32 EST 2001


Are you running 1.7?

   -Marty

Kevin.Brown at ...1022... wrote:
> 
> If that's the case then it's not in the config file I have.
> 
> > No, that's the minfrag preprocessor.  The defrag preprocessor performs
> > IP defragmentation and looks like this in the snort.conf file:
> >
> > preprocessor defrag
> 
> > > I don't want to assume anything, so by defrag preprocessor do you mean
> > > preprocessor minfrag: 128?
> 
> > > > Try commenting out the defrag preprocessor, If I disable mine, I go from
> > > > 99.9% cpu to about 20 or 30%.  Of course, you don't get alerted to some
> > > > things that way.
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users

--
Martin Roesch
roesch at ...421...
http://www.snort.org




More information about the Snort-users mailing list