[Snort-users] Snort 2.0 dropping packets
neil at ...1633...
Mon Apr 21 07:19:11 EDT 2003
Gary Flynn <flynngn at ...6811...> wrote to the Snort-users list:
>Edin Dizdarevic wrote:
>> memory is more important than CPU speed
>I hadn't heard this before. Does this apply only
>with stream reassembly enabled and lots of streams
>or to snort in general? Why?
My sense of it is that swapping of virtual memory on and off
the hard drive is one of the slowest operations the computer
carries out. If you have insufficient RAM, there is a lot of
memory swapping happening, and that slows the machine down
This is true not only for Snort and related activities. One
of the biggest mistakes inexperienced PC buyers make is to
get the latest and hottest CPU, and then choke it by skimping
on the RAM. Such a machine will perform *slower* than one
with a much slower CPU and buckets of memory.
Two things not to skimp on: RAM and disk space. Having taken
care of them, then get the fastest CPU your remaining budget
Just my humble opinion, of course.
Neil Dickey, Ph.D.
Northern Illinois University
More information about the Snort-users