[Snort-users] Sensor overload - Too much traffic for Snort box?

Ray H. snort at ...14147...
Sat Jun 9 01:05:35 EDT 2007

I will definitely try the tweaks Benjamin suggested.

As far as monitoring goes, all that I use currently are perfmon stats and
the associated perl script to generate the graphs every hour via cron.

During a one hour graph period that I happened to choose at the time I was
collecting the information to show here, the Mbit per sec graph shows a
minimum of 30 up to 60 Mbit/sec averaging around 40Mbit/sec.

The load average on the snort box never goes crazy after it fully
initializes and reads all the rules, it stays well below 1.0, around 0.15 to
0.4 on average.

Ray H.

-----Original Message-----
From: Fábio a.k.a Fósforo [mailto:fosforo at ...11827...] 
Sent: Friday, June 08, 2007 10:59 PM
To: Ray H.
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Sensor overload - Too much traffic for Snort box?

I would recommend to install a network/process monitoring tool like
monit (http://www.tildeslash.com/monit/) or zabbix (i've never tried
it), and like Benjamin Smal propose, see which parameter from /proc to
change after reading the reports.


On 6/8/07, Ray H. <snort at ...14147...> wrote:
> Having some trouble with dropped packets. Wondering if my snort box is
> powered or if I have my monitor session setup incorrectly, or something
> just overlooking.
> Any help would be greatly appreciated. I've tried to include all relevant
> information pertaining to my issue with dropped packets.

More information about the Snort-users mailing list