[Snort-users] Why Snort doubles packet number?

Santi Benito benisoroa at ...11827...
Thu May 11 06:36:02 EDT 2006

Hi Snorters,
I am replaying with Tcpreplay a file that has 1644419 packets by
eth1.This interface is directly connected to eth1 in another computer
where is running snort.
When I press CTRL+C when the replay has finished, on statistic appear:

Snort received 3288840 packets (this number is just the double of 1644419)
    Analyzed: 3288840(100.000%)
    Dropped: 0(0.000%)

Why occurs this thing?
Thanks a lot!

More information about the Snort-users mailing list