RE: SNORT DROPPING PACKETS

["Crow, Owen" <Owen_Crow () bmc com>]

Sorry, the thing that I haven't gotten to work on Linux is an accurate count
of dropped packets.  That's not clear the way I wrote it.  The SIGUSR1 thing
still prints out the stats.

I'm a Debian user mostly, but after upgrading the kernel and recompiling
libpcap and snort (and tcpdump, too) I always got 0% packets dropped on a
fully saturated 100Mbit pipe.  I tried investigating, but there seems to be
very little info on getting this to work accurately in 2.4 (not in any FAQs
I could find, etc.)  I tried the latest CVS of libpcap, but it just made
snort core dump.  If anyone knows how to make it work, please fess up.
Answers containing "switch to Redhat/SuSE" will be ignored.

Peace,
Owen

-----Original Message-----
From: Greg Herlein [mailto:gherlein () herlein com]
Sent: Sunday, December 23, 2001 11:17 AM
To: Crow, Owen
Cc: 'Bartholomew Simpson'; snort-users () lists sourceforge net
Subject: RE: [Snort-users] SNORT DROPPING PACKETS


> I was surprised to find this isn't listed in the manual or the FAQ list.
> It's been covered repeatedly on the list.
>
> On Unix systems send SIGUSR1 to the Snort process:
>
>       kill -USR1 <snort_pid>
>
> I don't know how on Win32 systems.  Linux systems require patching to make
> this work as far as I can tell.  I never found out how on a 2.4 system, so
I
> switched to FreeBSD.  

This is the kind of anti-linux FUD that sometimes really annoys
me.  Of course sending signals works on linux - you don't need a
patch.

It works fine - I just did it on a stock SuSE 2.4.4 kernel and a
2.4.14 kernel - both production machines.

Nothing against FreeBSD - that's a fine OS as well.  But geesh,
check your facts about linux.

Now Win32 - that's another story.  I won't go there.

Greg

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users