[Snort-users] Snort-Inline, IPTables and Performance

Matt Linton mlinton at ...10499...
Thu Aug 25 08:47:48 EDT 2005


With "ACCEPT" instead of "QUEUE" for all the rules, I get almost exactly 
the same throughput (+/- about 3k/sec).

My hardware is pretty robust, so I'm skeptical that it's the limiting 
factor.  Dell PowerEdge 2650, 2GB RAM, Dual Xeon 3.06GHz processors, 
Dual Broadcom 57xx Gigabit adapters for the network side (on board), and 
it's 100% dedicated to snort-inline/ACID.

Current stats are:  load average: 0.14, 0.07, 0.02   free memory: 1.3GB, 
CPU 99.5% Idle

This box should definately be able to push at least 25 megabits.  The 
switch on one side and router interface on the other side are both 100Mb 
full, and the actual pipe to them is a T3.

I'm thinking that perhaps iptables itself has some default memory 
limits, or bandwidth throttling, that I may have triggered or can 
overcome somehow through config adjustments, but I must confess I'm not 
an iptables expert.

Will Metcalf wrote:

>What kind of throughput do you get if you don't QUEUE your data but
>just send it through the   firewall or bridge?  I guess what I mean is
>do you see the 2.5mbs if you change you QUEUE rules to ACCEPT rules? 
>Don't get me wrong the performance of ip_queue stinks.  You have to
>perform two context switches for every packet which introduces a lot
>of latency.  Dropping from a 2.5mbs to 300k seems a little excessive
>though....
>
>If anybody would like to volunteer, I would still like to see some
>real performance tests done on snort-inline.  I do all of my
>development work on a PIII 450, this should give you some idea of the
>resources I have available to me ;-)
>
>I would like to see tests done with some decent server hardware
>Operteron or Xeon and a real testing suite like spirents reflector. 
>Any takers?
>
>Regards,
>
>Will
>
>On 8/24/05, Matt Linton <mlinton at ...10499...> wrote:
>  
>
>>Greetings;
>>
>>If anyone has the time to chat performance, I'm seeing some quite
>>problematic performance throttling when using snort-inline with
>>iptables, and I've been able to get much better performance previously
>>than this.
>>
>>My build is:  Red Hat Workstation 4 (Linux 2.6.9-5ELsmp) on a Dell
>>PowerEdge 1650 with dual Broadcom gigabit adapters.  I'm using Snort
>>version 2.3.0 and pushing things through a QUEUE iptables directive to
>>do inline IPS.
>>
>>Without the snort-inline box in place, I can attain about 2.5Mb/sec
>>downloads on my line.  With it in place, I'm stuck at about 300kb/sec
>>
>>I currently log to MySQL (ACID) but disabling MySQL, offloading it to
>>other machines and kicking up the memcap for stream4 (from 8 megs to
>>256) have made no difference so far.
>>
>>The server load is about 0.01 and I'm not seeing it struggle at all --
>>has anyone else done performance tuning on snort to this degree? Are
>>there some iptables directives I can use to improve performance?
>>
>>
>>-------------------------------------------------------
>>SF.Net email is Sponsored by the Better Software Conference & EXPO
>>September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
>>Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
>>Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
>>_______________________________________________
>>Snort-users mailing list
>>Snort-users at lists.sourceforge.net
>>Go to this URL to change user options or unsubscribe:
>>https://lists.sourceforge.net/lists/listinfo/snort-users
>>Snort-users list archive:
>>http://www.geocrawler.com/redir-sf.php3?list=snort-users
>>
>>    
>>
>
>
>-------------------------------------------------------
>SF.Net email is Sponsored by the Better Software Conference & EXPO
>September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
>Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
>Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list
>  
>




More information about the Snort-users mailing list