[Snort-users] Performance again

Brian bmc at ...950...
Tue Dec 23 07:07:01 EST 2003

On Tue, Dec 23, 2003 at 03:19:16PM +0100, Edin Dizdarevic wrote:
> Therefore I took out some lines from my perfmon.log and tried to
> compare different situations, in which Snort were loosing packets.
> My first conclusion is, that the bigger the packets are, the more
> packets are being dropped, while the open sessions count has almost
> no influence. Interessting, that Snort will handle more than 700
> sessions simultaneously with no packet loss :) (I only included
> the lines where packet drops occured).

Your method for coming to your conclusion is invalid.  You can not
ignore what happens before snort drops packets, as that is probably
what is causing the drop.  If you need finer grained information, set
perfmonitor to dump its data more frequently.


More information about the Snort-users mailing list