[Snort-users] Snort ignoring stream4

Frank Knobbe frank at ...9761...
Wed Apr 18 12:16:20 EDT 2007

On Mon, 2007-04-16 at 14:50 -0400, Paul Melson wrote:
> Hey Joel and anyone else that has any more ideas, I am still experiencing
> performance issues with this sensor.  I built and added
> 'search-method ac-bnfa' to snort.conf and have seen no performance change.
> I tried building with or without the dynamic engine and processors and that
> doesn't seem to make a difference, either.  Any additional ideas?  What
> could I be missing here?  I can run on for now, but I'd like to know
> that I have an upgrade path.

If performance is more important that the slightly higher accuracy in
alerts, why not run an older version of Snort? (like 2.4.x)  No need to
always HAVE the latest versions of software. I still use some software
from the late nineties because it still works great and gives me what I
need (interestingly, a lot of these are less bloated and more stable
that newer versions of the same or similar products.... hmmmmm....)


It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070418/664917d3/attachment.sig>

More information about the Snort-users mailing list