[Snort-users] Snort 2.0 dropping packets

Bennett Todd bet at ...6163...
Mon Apr 21 07:17:07 EDT 2003


2003-04-21T09:07:15 Gary Flynn:
> Edin Dizdarevic wrote:
> >memory is more important than CPU speed
> 
> I hadn't heard this before. Does this apply only
> with stream reassembly enabled and lots of streams
> or to snort in general? Why?

This applies as long as stream reassbly, or the conversation
preprocessor (prerequisite to portscan2) are enabled.

By chopping out enough preprocessors you can turn snort
into a slightly juicy brother of ngrep, stateless, free of
traffic-dependent memory consumption. But memory is cheap enough so
this doesn't feel like a good optimization.

-Bennett
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030421/af854acd/attachment.sig>


More information about the Snort-users mailing list