[Snort-users] Snort IPS - slow file transfer problem

wkitty42 at ...14940... wkitty42 at ...14940...
Wed Jun 15 09:03:20 EDT 2016

On 06/15/2016 07:59 AM, Anton Bezkrovny wrote:
> Hello!
> I have faced a problem of low speed of files copying during Snort realization in
> the IPS mode.
> The file is copied from one computer to another, communication between them is
> provided through Snort bridge.

what are the specs of the snort bridge? CPU, RAM, NICs being the most 
important... what we're looking for is a bottleneck... maybe the CPU is in high 
usage during the file transfer or possibly you have a lot of swap being used... 
consumer-grade NICs generally rely on the CPU to do the heavy lifting of data 
moving whereas server-grade NICs do that heavy lifting on their own which leads 
to faster processing...

assuming your snort bridge is a *nix box, what does your resource consumption 
look like?

   free -m; echo; top -n 1 -b | head -n 5

  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

More information about the Snort-users mailing list