[Snort-users] Packet loss

Jet yenjet at ...11827...
Fri Nov 26 22:57:00 EST 2004


I believe the loss packet rate is reported from PCAP library, not by Snort.
And it depend on the OS and libpcap version.

winpcap = So it reports correct.
Libpcap (Linux) = Pls upgrade to version 0.7.2 or above.
Using any version older than this will always have 0% loss packet reported.

On Fri, 26 Nov 2004 09:05:43 -0600, Cesar Sanabria Pineda
<csanab at ...12650...> wrote:
> Is there a way to know how many packets snort is loosing?. I mean i
> suppouse that while snort is processing a packet it's possible that some
> packets pass without been catched and analized by snort. I can i get a
> metric about that.

--
Jet




More information about the Snort-users mailing list