[Snort-users] BPF/libpcap performance, was Re: Seg Fault

Ashley Thomas athomas at ...3539...
Tue Feb 26 15:11:02 EST 2002


the packets that Snort processes does'nt touch the tcp/ip stack so would
those parameters matter ??

all the packets to snort is directly from libpcap which is from the
interface ...

ashley


On Tue, 26 Feb 2002, Erek Adams wrote:

> On Tue, 26 Feb 2002, Chris Green wrote:
>
> > FYI, its BPF/libpcap performance and not TCP stack performance that is the
> > issue when it comes to snort
>
> Ok, with that being said, here's a question:  Is it worth upgrading to another
> version of libpcap each time it comes out?  Or tracking it's CVS as well?
>
> Along those lines, would there be any useful TCP/IP stack parameters to
> tune/change, or would that just be a waste of effort?
>
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>





More information about the Snort-users mailing list