[Snort-users] Slow custom preprocessor

Sanjai Narain narain at ...13750...
Fri Jun 2 07:32:49 EDT 2006

It is possible that my custom preprocessor is consuming packets at a 
rate slower than they are being handed to it by Snort. If this is the 
case, I would appreciate any suggestions for how to handle it. Are there 
any buffers that one can increase? I did check the Snort statistics when 
it terminates and it showed 0% packet loss. This leads me to believe 
that the custom preprocessor might be too slow, not Snort itself. 
Thanks. -- Sanjai

More information about the Snort-users mailing list