[Snort-users] Low Snort performances

Gianluca Murgia gianluca.murgia at ...11669...
Mon Apr 19 02:03:11 EDT 2004


I'm using snort 2.1 with a Dual Intel P3 1266MHz 2GB RAM, OS Redhat 7.3 (
kernel 2.4.18-3smp ). I use it to monitor the traffic on a fddi token ring
network. The traffic can be up to 50MB/s and the network cards are
SysKonnect SK-5844 10/100 Mb/s.

The snort config file is set to reassemble the packets.

The maximum rate I can sniff without loss of packets is up to 4Mb/s. What's
the problem? Is there any kind of important setting on the machine that is
missing? On the other hand, which settings or services must not be running
on the machine in order to improve the performances?

Thanks, Luca

More information about the Snort-users mailing list