[Snort-users] BPF/libpcap performance, was Re: Seg Fault

Erek Adams erek at ...577...
Tue Feb 26 15:20:07 EST 2002


On Tue, 26 Feb 2002, Ashley Thomas wrote:

>
> the packets that Snort processes does'nt touch the tcp/ip stack so would
> those parameters matter ??
>
> all the packets to snort is directly from libpcap which is from the
> interface ...

Right...  I guess I should have been more specific in what I was asking...  :)

Many folks use some of the blueprint settings from the "Solaris Operating
Environment Network Settings for Network Security"
http://www.sun.com/blueprints/1200/network-updt1.pdf.  I'm wondering should I
rework my jumpstarts to provide for a less tweaked version for a sensor.  Or
if I should just continue to use the 'normal' settings that I've got configed
already.

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list