[Snort-users] 2.1.3rc1 Performance

Dirk Geschke Dirk_Geschke at ...1344...
Wed May 19 07:33:05 EDT 2004

Hi Gary,

> Yesterday I replaced my 2.1.1RC1 build with 2.1.3RC1.  Today I checked the 
> perfmon stats and nearly fell off my chair.  They are reporting that snort 
> is dropping on average about 15% of traffic.  With 2.1.1RC1 perfmon has 
> always reported 0% pkts dropped and I believed it.  Now I am seeing that 
> there are times when snort is dropping as much as 89%, and that is at 
> times with only 0.9mbps throughput and using 11% of the cpu.  Some other 
> times i am seeing drop rates of 12% with 5.1mbps throughput while using 
> 77% of the cpu.

did you use the same rules on both versions? There are a lot of changes
between these two versions especially an increase in the use of pcre...

And did you also use the same libpcap?

Best regards


More information about the Snort-users mailing list