[Snort-users] High Speed Network Cards + rules?

James Riden j.riden at ...11179...
Mon May 24 23:06:01 EDT 2004


Matt Kettler <mkettler at ...4108...> writes:

>          3) Be sure to use a high performance PCAP library like the
> MMAPed IO one from Phil Wood.

Has anyone managed to get this working when using --enable-flexresp as
well? 

First ./configure complained about missing libnet.h, so I grabbed
version 1.0.2a - then there was a compile error in sp_react.c. I'm
probably doing something stupid, so I'll give it a look over in the
morning before I post the error.

It did seem to bring the number of packets dropped down below 1%
though, so it's worth trying if you need the extra performance.

cheers,
 Jamie
-- 
James Riden / j.riden at ...11179... / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/





More information about the Snort-users mailing list