[Snort-users] How To Measure Promiscuous Mode ...

John Crain port123tcp at ...131...
Thu Jul 24 05:25:20 EDT 2003

I read that placing an interface in promiscuous mode increases system utilization, but I didn't find any specifics. Does anyone have any suggestions on how to measure the impact on a system by placing an interface in promiscuous mode?
Q1: Would the impact on the system be dependent on the number of packets the system had to process?
Q2: To take accurate measurements, would you agree that a packet generator would be necessary for testing?
Q3: If yes to Q2, is it possible to build a packet generator to spit out the exact same type and number of packets for repeated testing?
Q4: If a sensor interface with no IP address is attached to a SPAN port, does the sensor interface need to be in promiscuous mode? (I don't believe it does since all packets on the switch/router are being shot at the sensor and the sensor has no IP address to discern.)
Q5: If a sensor interface with an IP address is attached to a SPAN port and the interface is not in promiscuous mode, will the sensor interface be able to "see" all packets from the SPAN port?

Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030724/8f030a0d/attachment.html>

More information about the Snort-users mailing list