[Snort-users] BPF/libpcap performance, was Re: Seg Fault

Ashley Thomas athomas at ...3539...
Tue Feb 26 15:11:02 EST 2002

the packets that Snort processes does'nt touch the tcp/ip stack so would
those parameters matter ??

all the packets to snort is directly from libpcap which is from the
interface ...


On Tue, 26 Feb 2002, Erek Adams wrote:

> On Tue, 26 Feb 2002, Chris Green wrote:
> > FYI, its BPF/libpcap performance and not TCP stack performance that is the
> > issue when it comes to snort
> Ok, with that being said, here's a question:  Is it worth upgrading to another
> version of libpcap each time it comes out?  Or tracking it's CVS as well?
> Along those lines, would there be any useful TCP/IP stack parameters to
> tune/change, or would that just be a waste of effort?
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list