Re: porno rules -- portscan2 &c

[Skip Carter <skip () taygeta com>]

> > I've only heard of one person who gets decent results with it (I think 
> > that's Erek) and that person admits their network is "not typical".
>
> Hmmm.  Maybe there's two of us now ....  ;-)

        It would seem that those of use using it have not had much reason to
speak up.  I haven't had too much problem with it either.

On a 733Mhz PIII (256Mb RAM) running OpenBSD 3.2:

   Snort analyzed 8722507 out of 8757313 packets, 
   dropping 34806(0.397%) packets  


On a 300 Mhz PIII (128Mb RAM) running Linux 2.2.14:

 Snort analyzed 4506483 out of 4506483 packets, 
 dropping 0(0.000%) packets  


> >         - spp_conversation and portscan2 will triple the memory 
> > requirements of snort 1.9.1, not sure about 2.x as it's general memory 
> > needs went up.
>
> I'm using 2.0.0 -- maybe it's better behaved.

        I'm using 1.9.1 on both systems.


 

Skip



-- 
 Dr. Everett (Skip) Carter      Phone: 831-641-0645 FAX:  831-641-0647
 Taygeta Scientific Inc.        INTERNET: skip () taygeta com
 1340 Munras Ave., Suite 314    WWW: http://www.taygeta.com
 Monterey, CA. 93940            













-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users