[Snort-users] 2.1.3rc1 Performance

Gary_Portnoy at ...11307... Gary_Portnoy at ...11307...
Wed May 19 10:45:06 EDT 2004

Chad, Dirk,

I kept recompiling and testing with different versions of libpcre and 
libpcap.  And what do you know: 
Snort 2.1.3-RC1 with libpcre 4.5 and libpcap 0.8.3 reports dropping tons 
of packets
Snort 2.1.3-RC1 with libpcre 4.5 and libpcap 0.7.2 reports dropping 0% of 
I also noticed that Flushes/sec has gone down by a factor of 2 with 0.7.2

My problem is solved (I think....). 
The question remains however, which version is misreporting statistics? I 
suspect 0.8.3 since it reported 128.633% drop rate at one point.
Or is 0.8.3 just that much slower? 

Anyone care to comment?

Gary Portnoy

"Kreimendahl, Chad J" <Chad.Kreimendahl at ...4716...>
05/19/2004 12:55 PM

        To:     <Gary_Portnoy at ...11307...>
        cc:     "Dirk Geschke" <Dirk_Geschke at ...1344...>, 
<snort-users at lists.sourceforge.net>
        Subject:        RE: [Snort-users] 2.1.3rc1 Performance

By the way... My tests were done with an older (not .8) version of
libpcap.  I'll attempt the new one in development very soon. 

-----Original Message-----
From: Gary_Portnoy at ...11307... [mailto:Gary_Portnoy at ...11307...] 
Sent: Wednesday, May 19, 2004 11:46 AM
To: Kreimendahl, Chad J
Cc: Dirk Geschke; snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] 2.1.3rc1 Performance

Heh.... And here I am running on a Sun Ultra-2, with dual processors,
card,  and 1GB of Ram.  I thought snort was keeping up, but apparently 
just barely.  The maximum throughput i am seeing is about 5.5Mbps and 3k


Gary Portnoy

This message is for the named person's use only. This communication is for 
informational purposes only and has been obtained from sources believed to 
be reliable, but it is not necessarily complete and its accuracy cannot be 
guaranteed. It is not intended as an offer or solicitation for the purchase
or sale of any financial instrument or as an official confirmation of any
transaction. Moreover, this material should not be construed to contain any
recommendation regarding, or opinion concerning, any security. It may
contain confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission. If
you receive this message in error, please immediately delete it and all
copies of it from your system, destroy any hard copies of it and notify the
sender. You must not, directly or indirectly, use, disclose, distribute, 
print, or copy any part of this message if you are not the intended 
recipient.  Any views expressed in this message are those of the individual
sender, except where the message states otherwise and the sender is 
authorized to state them to be the views of any such entity.

ITG Inc. reserves the right to monitor and archive all electronic 
communications through its network. 

ITG Inc. Member NASD, SIPC

More information about the Snort-users mailing list