[Snort-users] Snort 2.0 dropping packets

Neil Dickey neil at ...1633...
Mon Apr 21 07:19:11 EDT 2003


Gary Flynn <flynngn at ...6811...> wrote to the Snort-users list:

>Edin Dizdarevic wrote:
>
>> memory is more important than CPU speed
>
>I hadn't heard this before. Does this apply only
>with stream reassembly enabled and lots of streams
>or to snort in general? Why?

My sense of it is that swapping of virtual memory on and off
the hard drive is one of the slowest operations the computer
carries out.  If you have insufficient RAM, there is a lot of
memory swapping happening, and that slows the machine down
dramatically.

This is true not only for Snort and related activities.  One
of the biggest mistakes inexperienced PC buyers make is to
get the latest and hottest CPU, and then choke it by skimping
on the RAM.  Such a machine will perform *slower* than one
with a much slower CPU and buckets of memory.

Two things not to skimp on:  RAM and disk space.  Having taken
care of them, then get the fastest CPU your remaining budget
will allow.

Just my humble opinion, of course.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115




More information about the Snort-users mailing list