snort on obsd performance

["skop d'skop" <skop () visto com>]

all
i'm running openbsd 2.8 (i386) 
// cpu0: Intel Pentium II (Klamath) ("GenuineIntel" 686-class, 512KB L2 cache) 267 MHz
//real mem  = 66682880 (65120K)

compile my kernel with this add option (as on openbsd faq)
//option          NMBCLUSTERS=2048

yet my server still can't handle large traffic (2+2)  even with -A fast .
recently it stop the service after 30-40 minutes of running (snort -d -A fast -c snort.conf -l /var/log/snort )
surprising it works well as on same set up for firewall using ipf/ipnat.

anyone has tips on improving the performance / tuning of openbsd to handle large traffic ?




 

-skop

___________________________________________________________________________
Visit http://www.visto.com.
Find out  how companies are linking mobile users to the 
enterprise with Visto.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users