[Snort-users] Slow custom preprocessor

snort user snort.user at ...11827...
Fri Jun 2 10:36:54 EDT 2006

If the custom preprocessor is slow in processing packets, it eventually
makes the whole snort application that you are running slow.

In that case, the snort should be dropping packets more frequently than

Did you do any measurements by increasing the traffic from a 'low' to
'high' value and check when the application starts dropping packets.

You can do the same with and without the preprocessor turned on.


On 6/2/06, Sanjai Narain <narain at ...13750...> wrote:
> It is possible that my custom preprocessor is consuming packets at a
> rate slower than they are being handed to it by Snort. If this is the
> case, I would appreciate any suggestions for how to handle it. Are there
> any buffers that one can increase? I did check the Snort statistics when
> it terminates and it showed 0% packet loss. This leads me to believe
> that the custom preprocessor might be too slow, not Snort itself.
> Thanks. -- Sanjai
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list