[Snort-users] Poor bandwidth using snort in afpacket mode

Russ Combs rcombs at ...1935...
Tue Apr 5 15:13:45 EDT 2011

On Tue, Apr 5, 2011 at 3:05 PM, carlopmart <carlopmart at ...11827...> wrote:

> On 04/05/2011 08:32 PM, Russ Combs wrote:
> > You could try commenting out the normalize_* to see if it is doing
> > anything your traffic doesn't tolerate very well.
> >
> Perfect!! .. But why?? I don't understand because normalize_* configs
> are supposed to work inline mode, no?

You mean disabling normalize_* brought your throughput up to what you
expected?  You could try disabling just one at a time to narrow it down.

Yes, normalization only applies to inline.  We have some tweaks for that
coming out in the next release but really you'd need to capture some packets
to see exactly what the issue is.

> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
> ------------------------------------------------------------------------------
> Xperia(TM) PLAY
> It's a major breakthrough. An authentic gaming
> smartphone on the nation's most reliable network.
> And it wants your games.
> http://p.sf.net/sfu/verizon-sfdev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110405/7218bfa6/attachment.html>

More information about the Snort-users mailing list