[Snort-users] porno rules -- portscan2 &c

Skip Carter skip at ...1552...
Tue Apr 29 16:18:02 EDT 2003

> >I've only heard of one person who gets decent results with it (I think 
> >that's Erek) and that person admits their network is "not typical".
> Hmmm.  Maybe there's two of us now ....  ;-)

	It would seem that those of use using it have not had much reason to
speak up.  I haven't had too much problem with it either.

On a 733Mhz PIII (256Mb RAM) running OpenBSD 3.2:

   Snort analyzed 8722507 out of 8757313 packets, 
   dropping 34806(0.397%) packets  

On a 300 Mhz PIII (128Mb RAM) running Linux 2.2.14:

 Snort analyzed 4506483 out of 4506483 packets, 
 dropping 0(0.000%) packets  

> >         - spp_conversation and portscan2 will triple the memory 
> >requirements of snort 1.9.1, not sure about 2.x as it's general memory 
> >needs went up.
> I'm using 2.0.0 -- maybe it's better behaved.

	I'm using 1.9.1 on both systems.



 Dr. Everett (Skip) Carter      Phone: 831-641-0645 FAX:  831-641-0647
 Taygeta Scientific Inc.        INTERNET: skip at ...1552...
 1340 Munras Ave., Suite 314    WWW: http://www.taygeta.com
 Monterey, CA. 93940            

More information about the Snort-users mailing list