[Snort-users] Re: AW: (Snort-users) How to know if snort is dropping packets

Martin Roesch roesch at ...1935...
Thu Nov 1 08:49:12 EST 2001


Download the CVS from last night (or snort-current.tar.gz at snort.org),
it should work now.

     -Marty

sandro.poppi at ...3316... wrote:
> 
> > Marc-Andre Hamelin wrote:
> > >
> > > Hi all,
> > >
> > > Anyone as a way to know in real time if snort is dropping
> > packets without
> > > having to stop the processes and restart them ?
> > > Also, how about when the processes are running in daemon mode ?
> >
> > Send the Snort process a SIGUSR1, if it's running on daemon mode it
> > prints to syslog, if it's running on the console it'll print to that
> > display.
> >
> >      -Marty
> 
> Marty,
> 
> when sending snort SIGUSR1 this only works once so I have to restart snort to
> get further statistics. I'm running snort on RedHat 7.0/7.1 in daemon mode. Is
> this normal behaviour or do I miss something?
> 
> Thanks,
> Sandro

--
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...1935... - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org




More information about the Snort-users mailing list