[Snort-users] SnortSnarf performance

Ralf Hildebrandt Ralf.Hildebrandt at ...821...
Wed Mar 28 01:52:44 EST 2001

On Tue, Mar 27, 2001 at 02:25:14PM -0500, Tony Lill wrote:

> 1) DNS lookups - a lot of alerts are generated by sites without
> addr to name mappings. Each of these failures causes a 90s stall,
> although I presume you have these turned off.

Isn't that done by negative caching within the nameserver? (Or nscd on
Solaris, although this isn't a great piece of software)

ralf.hildebrandt at ...821...                            innominate AG
System Engineer                        Don't be afraid of what you see -
Diplom-Informatiker                     be afraid of what you don't see!
tel: +49.(0)7000.POSTFIX  fax: +49.(0)30.308806-698         

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20010328/315c2311/attachment.sig>

More information about the Snort-users mailing list