[Snort-users] snort inline with jumbo frame

王聲浩(Sheng-Hao Wang) lounge_sam at ...125...
Sun Sep 9 23:27:54 EDT 2012


Hi all, 

I am trying to run snort inline with jumbo frame traffic, the size of packet could raise to 65524.
But I face a weird phenomenon, when I enable jumbo frame, the throughput with snort inline decreases to very low.

Here is my test result:

      jumbo frame baseline
     525Mbps
     
      jumbo frame with snort inline
     4Mbps
     
      MTU 1500 baseline
     48Mbps
     
      MTU 1500 with snort inline
     37Mbps
     


My snort version is 2.9.2.3 and I use command "snort -N -d --daq nfq -Q -c /etc/snort/snort.conf".

I have tried the solution of http://blog.inliniac.net/2008/01/23/improving-snort_inlines-nfq-performance
But it doesn't work.  

Does anyone have any idea? Thanks.

Sam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120910/d1fafab8/attachment.html>


More information about the Snort-users mailing list