Re: [Snort-users] Low Snort performances

Ciao!

Snort's "performance" mostly depends on how many rules you have
activated. After setting your ruleset you may try to tune other
parameters, using fast alerting, barnyard, giving your preprocessors
more memory etc. Also using a good supported NIC is important, as well
as some kernel parameters. Anyway, there are many discussions covering
this, so you may also find one or another hint in one of the older
postings.

Regards,
Edin

Gianluca Murgia schrieb:

> Hi,
>
> I'm using snort 2.1 with a Dual Intel P3 1266MHz 2GB RAM, OS Redhat 7.3 (
> kernel 2.4.18-3smp ). I use it to monitor the traffic on a fddi token ring
> network. The traffic can be up to 50MB/s and the network cards are
> SysKonnect SK-5844 10/100 Mb/s.
>
> The snort config file is set to reassemble the packets.
>
> The maximum rate I can sniff without loss of packets is up to 4Mb/s. What's
> the problem? Is there any kind of important setting on the machine that is
> missing? On the other hand, which settings or services must not be running
> on the machine in order to improve the performances?
>
>
> Thanks, Luca
>

--
Edin Dizdarevic


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users