[Snort-users] BPF/libpcap performance, was Re: Seg Fault
erek at ...577...
Tue Feb 26 15:20:07 EST 2002
On Tue, 26 Feb 2002, Ashley Thomas wrote:
> the packets that Snort processes does'nt touch the tcp/ip stack so would
> those parameters matter ??
> all the packets to snort is directly from libpcap which is from the
> interface ...
Right... I guess I should have been more specific in what I was asking... :)
Many folks use some of the blueprint settings from the "Solaris Operating
Environment Network Settings for Network Security"
http://www.sun.com/blueprints/1200/network-updt1.pdf. I'm wondering should I
rework my jumpstarts to provide for a less tweaked version for a sensor. Or
if I should just continue to use the 'normal' settings that I've got configed
More information about the Snort-users