[Snort-users] snort inline (non-drop mode) br0

Paul Halliday paul.halliday at ...11827...
Wed Feb 2 12:19:25 EST 2011

On Wed, Feb 2, 2011 at 1:10 PM, Lawrence R. Hughes, Sr.
<lhughes at ...14822...> wrote:
> Joel,
> Thank-you for your reply, but where do we go from here, as you well know
> this amount of dropped packets is not acceptable?

My setup is span and at one point I was seeing a large amount dropped
packets. It turned out to have something to do with ARP. Once they
turned it off, things stabilized.

</shot in the dark>

Paul Halliday

More information about the Snort-users mailing list