[Snort-users] Snort dropping more packets than it received

Peter Bates peter.bates at ...15381...
Wed Sep 12 11:56:20 EDT 2012


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello all

On 12/09/2012 16:19, Scott Finlon wrote:
> I just installed Snort to run on 8 instances via PF_RING DNA, and
> whenever I dump the stats via kill -usr1 or end the processes the
> numbers just don't add up. Is this an issue with the way Snort is
> adding, or could it be something else?

I'm not using DNA (just normal PF_RING) but my stats look considerably
more healthier than yours.

What sorts of stats are you seeing in /proc/net/pf_ring/x ?

Something on the lines of

egrep 'Packet|Lost' /proc/net/pf_ring/*|egrep -v ': 0'

is fairly useful.

- -- 
Peter Bates
Senior Computer Security Officer    Phone: +44(0)2076792049
Information Services Division	    Internal Ext: 32049
University College London
London WC1E 6BT
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQEcBAEBAgAGBQJQULCkAAoJELhVoVpEMS6RLN0H/jmcBFSEQs0j+31h44Kexbb1
b74KZsTcHBduouS1BsWG9gQ+fvmqHOwkfeOioaX262VMspLwIQ633HBowN7vdnoT
H3Shj0hF96Q+PG703i9LHxFa9s03YnL1k4ylQjo/3Nq+yjFXB1RWCUhMR0FyQFku
vhrA3LmnW8M4s4Ohd6sjOQZSJqoX5S44t5sfBkgJUvWCp/MGojeaX+tmYQs/gSiI
pkksEQTX4sNDZMHvjKLl/ZQv35Et5a2mC5PaZvV789yFADKpAScFn7WXmjA/Z8GQ
zHkFaP8lrrczLWYx7doJ7HwIj5LVxuzlF5A4hLZEKPw5BhXBRRYjlchk2r1W9x4=
=JtnX
-----END PGP SIGNATURE-----





More information about the Snort-users mailing list