[Snort-users] Snort distributions

Eoin Miller eoin.miller at ...14586...
Wed Apr 17 13:20:20 EDT 2013


On 3/6/2013 15:05, Joel Esler wrote:
> On Mar 6, 2013, at 9:33 AM, Jon M <megajune at ...11827...
> <mailto:megajune at ...11827...>> wrote:
> 
>> acceptable packet loss of less
>> than 5% on average.
> 
> Hate to say this, cause it seems like I'm being an ass… but..  there is
> no just thing as "acceptable packet loss"
> 

It can be acceptable. Sniffers running for research purposes or if the
cost is too great to achieve redundant monitoring of 40G networks. It
isn't even like if you have 100% monitoring that the existing signature
sets find all the evil going on anyways. :)

-- Eoin





More information about the Snort-users mailing list