<div>Well I got my head out of my butt and realized what my major issue was. I was running Snort from the command line for testing purposes before I set it up to run at boot as a Daemon. I was using the following command line:
<div>/usr/local/bin/snort -c /etc/snort/snort.conf -i eth1 -g snort -v</div>
<div>I kinda forgot that verbose mode will cause a ton of dropped packets like I was getting. I am now after a 10 min run without the -v getting 10% loss instead of 90%. That is something I could live with or at least close the gap on easier.
<div>I installed the new pcap library as suggested above. I am using Fedora Core 3 (yeah I know, don't say it :-P) and I downloaded the lib, un-tarred it, did the configure, make, make install dance around the fire pit. I rebooted the server. Will that pcap lib actually be used or is there something I have to change somewhere to tell FC3 not to use the pcap lib that it came with and to use my new one?
<div><span class="gmail_quote">On 10/26/05, <b class="gmail_sendername">Joseph Nicholson</b> <<a href="mailto:wjnicholson@...11827...">wjnicholson@...11827...</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">I went ahead and disabled all of the rulesets to see if that made any differece. Unfortunately it made no difference at all. My next question will be if I use the pcap library suggested above, when I install it will Snort know to use it automatically or will I have to change something so Snort will know?