[Snort-users] Snort 2.0 dropping packets
bet at ...6163...
Mon Apr 21 07:17:07 EDT 2003
2003-04-21T09:07:15 Gary Flynn:
> Edin Dizdarevic wrote:
> >memory is more important than CPU speed
> I hadn't heard this before. Does this apply only
> with stream reassembly enabled and lots of streams
> or to snort in general? Why?
This applies as long as stream reassbly, or the conversation
preprocessor (prerequisite to portscan2) are enabled.
By chopping out enough preprocessors you can turn snort
into a slightly juicy brother of ngrep, stateless, free of
traffic-dependent memory consumption. But memory is cheap enough so
this doesn't feel like a good optimization.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: not available
More information about the Snort-users