[Snort-users] snort inline with jumbo frame
howz.wang at ...11827...
Sun Sep 9 23:34:46 EDT 2012
I am trying to run snort inline with jumbo frame traffic, the size of packet could raise to 65524.
But I face a weird phenomenon, when I enable jumbo frame, the throughput with snort inline decreases to very low.
Here is my test result:
jumbo frame baseline
jumbo frame with snort inline
MTU 1500 baseline
MTU 1500 with snort inline
My snort version is 22.214.171.124 and I use command "snort -N -d --daq nfq -Q -c /etc/snort/snort.conf".
I have tried the solution of blog.inliniac.net/2008/01/23/improving-snort_inlines-nfq-performance
But it doesn't work.
Does anyone have any idea? Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users