[Snort-users] snort dropping 48%

Matt Kettler mkettler at ...4108...
Wed Apr 28 18:50:01 EDT 2004


At 01:46 PM 4/28/2004, Sheahan, Paul wrote:
>Now I've upgraded to a big beefy server, gig Ethernet, RH Linux 8.0 and 
>Snort 2.0.5 using the same Snort config as above. Traffic levels are the 
>same. Now I noticed it was dropping half of the traffic! My custom content 
>rules are extremely important to me, so I performed a test. I created this 
>bare bones snort.conf which basically disables all standard rules and 
>extra preprocessors:
<snip>
>Then I started Snort and let it capture traffic for a while. I stopped 
>Snort and it is STILL dropping 48% of the traffic! My "my.rules" file 
>contains a few hundred content-based rules. What gives? Can Snort no 
>longer handle content-based rules? Or am I missing something here?

Is it possible your pcap library that came with RH 8.0 is borked or 
reporting bad statistics (it's been known to happen on RedHat)?

How does tcpdump perform on the same system? Does it drop packets too? 





More information about the Snort-users mailing list