<div>I am working on tweaking my first snort sensor of four for my enviroment. I have run across something that concerns me, but part of me is saying it is not what I think it is. Any clarification will be appreciated.</div>
<div>When I run snort manually for testing I get the following when i stop it. I think the way i am reading this is incorrect. When I look at this, I see that snort dropped 179457 packets because it couldn't process them.
<div>Snort received 186246 packets<br> Analyzed: 6789(3.645%)<br> Dropped: 179457(96.355%)<br> </div>
<div>My gut instinct is telling me that it dropped 179457 packets because it felt there was no threat from them and that the 6789 it analyzed looked suspicious. </div>
<div>Once again thank you in advance for any information on this.<br clear="all"><br>-- <br>Joseph Nicholson</div>