[Snort-users] 2.1.3rc1 Performance

Dirk Geschke Dirk_Geschke at ...1344...
Wed May 19 07:33:05 EDT 2004


Hi Gary,

> Yesterday I replaced my 2.1.1RC1 build with 2.1.3RC1.  Today I checked the 
> perfmon stats and nearly fell off my chair.  They are reporting that snort 
> is dropping on average about 15% of traffic.  With 2.1.1RC1 perfmon has 
> always reported 0% pkts dropped and I believed it.  Now I am seeing that 
> there are times when snort is dropping as much as 89%, and that is at 
> times with only 0.9mbps throughput and using 11% of the cpu.  Some other 
> times i am seeing drop rates of 12% with 5.1mbps throughput while using 
> 77% of the cpu.

did you use the same rules on both versions? There are a lot of changes
between these two versions especially an increase in the use of pcre...

And did you also use the same libpcap?

Best regards

Dirk





More information about the Snort-users mailing list