[Snort-users] Snort/Linux Dropping Packets

snort user snortuser at ...125...
Tue Apr 27 07:39:02 EDT 2004


Well Ive been playing with snort just a little more and not just using my 
pretty GUI. What I noticed though is that snort is actually dropping a 
significant amount of packets. So I actually made a little test system with 
some parts around here. I put a gigE card in 2 machines one for snort and 
one for the 'attacker' and I ran some traffic with tcpreplay. What I noticed 
is that when snort hits about 200 Mbits/s there is a significant packet 

I tried using the libpcap-mmap version but there was no real change. There 
must be a way around this becuase Ive heard a lot of people running snort on 
linux. Is there any way to increase the amount of traffic snort can handle?


Lose those love handles! MSN Fitness shows you two moves to slim your waist. 

More information about the Snort-users mailing list