[Snort-users] question for snort flow established

waldo kitty wkitty42 at ...14940...
Mon Mar 18 12:10:16 EDT 2013


On 3/18/2013 10:35, Joel Esler wrote:
> Did you get the email I sent?

yes and i can see it maybe in that case... but i've not found the real specifics 
of the cause, yet... i also have to wonder if folks running snort on one machine 
and trying to test it from the same machine then end up leaving "-k none" in the 
startup options when they shouldn't...

BTW: i'll check my "offlist" folder again and see if there is another email from 
you in there... my offlist folders are read after my list folders ;)

eg:
Security Related
|->snort-users
|  |->offlist
|->emergingthreats
    |->offlist


> --
> *Joel Esler*
> Senior Research Engineer, VRT
> OpenSource Community Manager
> Sourcefire
>
> On Monday, March 18, 2013 at 11:29 AM, waldo kitty wrote:
>
>> On 3/18/2013 10:04, JJ Cummings wrote:
>>> Checksum offloading
>> [...]
>>>> [@ALL] why is this "-k none" suddenly needed more and more in recent months??
>>>> we've never used it in any of our snort installations... is it special to a
>>>> certain set of NICs?? [/@ALL]
>>
>> i understand that but /why/ is it needed now and hasn't been needed before? is
>> it for server grade NICs only? does it have to do with the quantity of traffic
>> flowing? is it related to gigabit NICs?






More information about the Snort-users mailing list