[Snort-users] snort dropping 48%

Frank Knobbe frank at ...9761...
Thu May 6 14:37:03 EDT 2004


On Thu, 2004-05-06 at 16:04, Sheahan, Paul wrote:
> Funny how this rules file and startup script worked perfectly on Snort
> 1.9 on 100mb Ethernet and a low end server, and I was using all the
> other default rules too. Odd. I've always loved Snort but now it has
> become completely useless. 

Mumpitz. You can always run the older version again.

The problem is finding out if it's the old hardware or software. You
should be able to determine that quickly by running your old Snort 1.9
setup on the new box. Also, run the new Snort set up on a different box.
There is always the chance that your Gigabit card doesn't work well
together with your system board, perhaps interrupt contention (dunno if
Linux has a DEVICEPOLLING option like BSD does). Moreover, try a
different NIC, and finally change the system.

Feel free to also try running a different OS. FreeBSD seems to perform
well with Intel Gigabit NICs.

Regards,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20040506/fa9ef194/attachment.sig>


More information about the Snort-users mailing list