[Snort-users] How To Measure Promiscuous Mode ...

John Crain port123tcp at ...131...
Thu Jul 24 05:25:20 EDT 2003


I read that placing an interface in promiscuous mode increases system utilization, but I didn't find any specifics. Does anyone have any suggestions on how to measure the impact on a system by placing an interface in promiscuous mode?
 
Q1: Would the impact on the system be dependent on the number of packets the system had to process?
 
Q2: To take accurate measurements, would you agree that a packet generator would be necessary for testing?
 
Q3: If yes to Q2, is it possible to build a packet generator to spit out the exact same type and number of packets for repeated testing?
 
Q4: If a sensor interface with no IP address is attached to a SPAN port, does the sensor interface need to be in promiscuous mode? (I don't believe it does since all packets on the switch/router are being shot at the sensor and the sensor has no IP address to discern.)
 
Q5: If a sensor interface with an IP address is attached to a SPAN port and the interface is not in promiscuous mode, will the sensor interface be able to "see" all packets from the SPAN port?
 
Thanks.
 
-John


---------------------------------
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030724/8f030a0d/attachment.html>


More information about the Snort-users mailing list