[Snort-users] network bandwidth downs when snort inoine is up

[Victor Julien]

carlopmart wrote:
> Yes: norm_wscale_max 14
>   
This should be ok. Can you past your entire stream4 config?

It doesn't have to be a stream4inline issue though. The number of sigs,
preprocessors, etc. can also slow things down. Especially the clamav
preproc.

Regards,
Victor


>
> Will Metcalf wrote:
>   
>> do you have window normalization enabled in your stream4inline config?
>>
>> On 10/9/07, carlopmart <carlopmart at ...11827...> wrote:
>>     
>>> hi all,
>>>
>>>   I have configured a snort inline on my home network. (i am using
>>> clamav preprocessor on it). First problem is bandwidth: downs from 310
>>> kb to 166 kb (previosly exists some fluctuations) ... Is this normal?
>>> Can I set up some kernel param to increase this bandwidth?? I am using
>>> rhel5 and snor-inline 2.6.1.5
>>>
>>> Many thanks.
>>>
>>> --
>>> CL Martinez
>>> carlopmart {at} gmail {d0t} com
>>>
>>> -------------------------------------------------------------------------
>>> This SF.net email is sponsored by: Splunk Inc.
>>> Still grepping through log files to find problems?  Stop.
>>> Now Search log events and configuration files using AJAX and a browser.
>>> Download your FREE copy of Splunk now >> http://get.splunk.com/
>>> _______________________________________________
>>> Snort-users mailing list
>>> Snort-users at lists.sourceforge.net
>>> Go to this URL to change user options or unsubscribe:
>>> https://lists.sourceforge.net/lists/listinfo/snort-users
>>> Snort-users list archive:
>>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>>>
>>>       
>
>
>