[Snort-users] 2.1.3rc1 Performance
Dirk_Geschke at ...1344...
Wed May 19 07:33:05 EDT 2004
> Yesterday I replaced my 2.1.1RC1 build with 2.1.3RC1. Today I checked the
> perfmon stats and nearly fell off my chair. They are reporting that snort
> is dropping on average about 15% of traffic. With 2.1.1RC1 perfmon has
> always reported 0% pkts dropped and I believed it. Now I am seeing that
> there are times when snort is dropping as much as 89%, and that is at
> times with only 0.9mbps throughput and using 11% of the cpu. Some other
> times i am seeing drop rates of 12% with 5.1mbps throughput while using
> 77% of the cpu.
did you use the same rules on both versions? There are a lot of changes
between these two versions especially an increase in the use of pcre...
And did you also use the same libpcap?
More information about the Snort-users