[Snort-users] slow transfers from a samba share

Daniel Struck community at ...12669...
Wed Nov 17 23:33:03 EST 2004


Just for the record, maybe some new snort users face the same problem ;-)

Someone on the snort-inline-users gave me the solution and it is so simple I wonder why I didn't find it out ;-)

You have just to tell snort to not put the card in promiscuous mode with the "-p" flag.


Daniel

On Tue, 16 Nov 2004 08:36:38 +0100
Daniel Struck <community at ...12669...> wrote:

> I found the cause. It is not snort but the wireless card driver. If i put the wireless card manually in promiscous mode I get the same slow transfer rates.
> It is the Hermes PCMCIA card support in kernel v2.6.9-gentoo-r3.
> 
> Will try out if linux-wlan-ng gives the same result.
> 
> 
> Daniel
> 
> 
> On Sun, 14 Nov 2004 17:39:07 +0100
> Daniel Struck <community at ...12669...> wrote:
> 
> > Hello,
> > 
> > 
> > I experience very slow transfer rates from a samba share and even ignore host with bpf doesn't help.
> > 
> > My specs:
> > 
> > - Snort Version 2.2.0 (Build 30)
> > - Gentoo ~x86
> > - Mobile AMD Athlon(tm) XP 2000+
> > - wireless connection
> > - samba share hosted on a nslu2-device with original firmware V2.3R25 (192.168.0.6, Samba 2.2.7b-ja-1.0)
> > 
> > 
> > Without snort I get a transfer rate of about 310KB/s from the samba share, as shown in the KDE transfer dialog.
> > 
> > But when I start snort with
> > "snort -u snort -i eth1 -l /var/log/snort -c /etc/snort/snort.conf"
> > I get a transfer rate of about 18 - 36 KB/s, ten times slower.
> > 
> > Even when I start snort with:
> > "snort -u snort -i eth1 -l /var/log/snort -c /etc/snort/snort.conf not host 192.168.0.6"
> > I get this slow samba transfer rate.
> > 
> > 
> > Does anyone else experience this problem?
> > 
> > 
> > Greetings,
> > 
> > Daniel Struck
> > 
> > 
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: InterSystems CACHE
> > FREE OODBMS DOWNLOAD - A multidimensional database that combines
> > robust object and relational technologies, making it a perfect match
> > for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: InterSystems CACHE
> FREE OODBMS DOWNLOAD - A multidimensional database that combines
> robust object and relational technologies, making it a perfect match
> for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list