[Snort-users] Snort/Linux Dropping Packets

snort user snortuser at ...125...
Tue Apr 27 07:39:02 EDT 2004


Hi,

Well Ive been playing with snort just a little more and not just using my 
pretty GUI. What I noticed though is that snort is actually dropping a 
significant amount of packets. So I actually made a little test system with 
some parts around here. I put a gigE card in 2 machines one for snort and 
one for the 'attacker' and I ran some traffic with tcpreplay. What I noticed 
is that when snort hits about 200 Mbits/s there is a significant packet 
loss.

I tried using the libpcap-mmap version but there was no real change. There 
must be a way around this becuase Ive heard a lot of people running snort on 
linux. Is there any way to increase the amount of traffic snort can handle?


--SU--

_________________________________________________________________
Lose those love handles! MSN Fitness shows you two moves to slim your waist. 
http://fitness.msn.com/articles/feeds/article.aspx?dept=exercise&article=et_pv_030104_lovehandles





More information about the Snort-users mailing list