[Snort-users] Snort + PF_RING + DAQ
livio at ...15149...
Tue Sep 4 14:06:01 EDT 2012
That is definitely strange. We have not tested the latest versions of
PFRING since it changes too quickly for us, assuming no major setbacks,
but you should be able to do many gigs..
Here are a few things I would look at:
o Do you have rules with long lists of IPs like [ip1,ip2,ip3,ip4...]
etc? These types of rules are horribly slow because snort matches them
linearly. If so, try disabling them and see if things improve (if so,
let me know we a plugin for that). You can also configure snort with
--enable-perfprofiling to see if there are bad rules that are taking
too much time.
o Does top show the processes are mostly mostly pegged in the 80%-100%
kind of evenly?
o Could it be contention caused by barnyard? Can you try without and see
if that helps?
o A big buffer can always help. When you load the pf_ring kernel module
give it at least 65k and place your interfaces in transparent mode 1 as in:
transparent_mode=1 min_num_slots=65536 (or even more than 65k if your
kernel can handle it). You might need to also increase the kernel memory
with vmalloc=256M as a boot parameter.
o On some of our processors we got very good performance improvements by
compiling snort with "-march=native -fomit-frame-pointer -O3"
o What does cat /proc/interrupts show? Do you map the eth* IRQs to
different CPUs or does CPU 0 do all the interrupts?
o Then there is the snort.conf.. I will let other people chime on that..
Here are just a few I can think of right now..
On 9/4/2012 7:15 AM, Peter Bates wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> Hello all
> I'd actually be interested in anyone's Snort tuning suggestions
> because I'm running Snort + PF_RING pretty much as per the Metaflows
> 10Gb instructions and still dropping traffic - this is with 1-2Gbps
> and about 1000 rules.
> Following the Metaflows route I was running 32 instances of Snort (and
> 32 x Barnyards) and the results were not encouraging.
> And before Joel says it, I do know you have a SF box you could sell me ;)
> - --
> Peter Bates
> Senior Computer Security Officer Phone: +44(0)2076792049
> Information Services Division Internal Ext: 32049
> University College London
> London WC1E 6BT
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.17 (MingW32)
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
> -----END PGP SIGNATURE-----
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
More information about the Snort-users