[Snort-users] high packet loss - low throughput

waldo kitty wkitty42 at ...14940...
Fri Jul 19 23:11:31 EDT 2013


On 7/18/2013 05:07, Michal Purzynski wrote:
> On 7/18/13 3:39 AM, waldo kitty wrote:
>> perhaps you are using protocol aware stream flushing and it needs tweaking?
> Yes, it's enabled with the same settings. Reading about it and I don't
> really want to disable it.
>>
>> ###############################################
>> # Configure protocol aware flushing
>> # For more information see README.stream5
>> ###############################################
>> config paf_max: 16000

FWIW: i wasn't suggesting to disable it but maybe to increase it... assuming, 
without reading the docs, that it is time before flushing...

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.




More information about the Snort-users mailing list