[Snort-users] Performance issues with SNORT

Ashley Thomas athomas at ...3539...
Fri Feb 8 09:58:03 EST 2002


when you replay the traffic, at how much "rate in Mbps"  are you replaying
it ?




On Fri, 8 Feb 2002, Vikalp Nagori wrote:

> We are trying to benchmark Snort-1.8.3 running on HP P3 933MHZ , 512Mb RAM on linux.
>
> We ran tcpreplay on defcon dump and realized snort dropping 33% packets with default preprocessors and rules.
>
> We disabled all the preprocessors and rules still snort is dropping 20% packets.
>
>  would like to have inputs -
>
> 1. Are we in right direction? what is the best way of benchmarking snort?
> 2. What is the configuration of hardware expected by snort to give its best performance on 100Mbps network?
> 3. What is the optimum settings (ruleset, preprocessors and output plugin) to get efficient performance from snort placed before firewall on 100Mbps network?
>
> Any help ???
>
>
> Vikalp Nagori
>
>
>





More information about the Snort-users mailing list