[Snort-users] Low Snort performances

Edin Dizdarevic edin.dizdarevic at ...7509...
Mon Apr 19 02:25:15 EDT 2004


Snort's "performance" mostly depends on how many rules you have
activated. After setting your ruleset you may try to tune other
parameters, using fast alerting, barnyard, giving your preprocessors
more memory etc. Also using a good supported NIC is important, as well
as some kernel parameters. Anyway, there are many discussions covering
this, so you may also find one or another hint in one of the older


Gianluca Murgia schrieb:

> Hi,
> I'm using snort 2.1 with a Dual Intel P3 1266MHz 2GB RAM, OS Redhat 7.3 (
> kernel 2.4.18-3smp ). I use it to monitor the traffic on a fddi token ring
> network. The traffic can be up to 50MB/s and the network cards are
> SysKonnect SK-5844 10/100 Mb/s.
> The snort config file is set to reassemble the packets.
> The maximum rate I can sniff without loss of packets is up to 4Mb/s. What's
> the problem? Is there any kind of important setting on the machine that is
> missing? On the other hand, which settings or services must not be running
> on the machine in order to improve the performances?
> Thanks, Luca

Edin Dizdarevic

More information about the Snort-users mailing list