[Snort-users] snort dropping 48%
snort_on_acid at ...131...
Thu May 6 14:13:10 EDT 2004
Might I suggest using freeBSD? RH will use all of the
memory you give it and libcap is not the best
performer. You can also try getting a bigger processor
and/or tuning your rules, starting with disabling the
content-based rules, narrowing down your
>Subject: RE: [Snort-users] snort dropping 48%
>Date: Thu, 6 May 2004 14:02:59 -0400
>From: "Sheahan, Paul" <Paul.Sheahan at ...2218...>
>To: <snort-users at lists.sourceforge.net>
>Cc: "snort user" <snortuser at ...125...>
>I still don't have an answer either. 49% of packets
>being dropped is
>I recently ran TOP to check memory while Snort was
>content-based rules and noticed that even though I
>had 1 gig of ram in
>my server, there was almost no free memory. So I
>upgraded to 4 gig of
>RAM figuring Snort just needed more RAM, but the same
>problem is still
>occurring, 49% of packets are still being dropped.
>Should I take a look at libpcap? I understand there
>versions. What version should I be running?
Do you Yahoo!?
Win a $20,000 Career Makeover at Yahoo! HotJobs
More information about the Snort-users