[Snort-users] snort inline with jumbo frame

王聲浩(Sheng-Hao Wang) howz.wang at ...11827...
Sun Sep 9 23:34:46 EDT 2012

Hi all, 

I am trying to run snort inline with jumbo frame traffic, the size of packet could raise to 65524.
But I face a weird phenomenon, when I enable jumbo frame, the throughput with snort inline decreases to very low.

Here is my test result:

      jumbo frame baseline
      jumbo frame with snort inline
      MTU 1500 baseline
      MTU 1500 with snort inline

My snort version is and I use command "snort -N -d --daq nfq -Q -c /etc/snort/snort.conf".

I have tried the solution of blog.inliniac.net/2008/01/23/improving-snort_inlines-nfq-performance
But it doesn't work.  

Does anyone have any idea? Thanks.

Best Regards,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120910/ab558e77/attachment.html>

More information about the Snort-users mailing list