[Snort-users] BPF size on OpenBSD and multiple NICs

skop d'skop skop at ...2175...
Sun Jun 10 21:52:23 EDT 2001


in my experience this packet drop is dealing with NIC. my box use Intel NIC.



-----Original Message-----
From:    Subba Rao subba9 at ...530...
Sent:    Sat, 9 Jun 2001 11:58:30 +0000
To:      snort-users at lists.sourceforge.net
Subject: [Snort-users] BPF size on OpenBSD and multiple NICs


What should be the limit of OpenBSD's BPF for running Snort effectively? I would
like to use one OpenBSD box with a 4-port NIC. Using TCPDUMP, I see quite a few
packets getting dropped (sometimes it is as much as 50%). Since Snort is the
other sniffer, this will be used for IDS. Does Snort drop packets as much as
TCPDUMP does?



More information about the Snort-users mailing list