Re: Snort 2.0 dropping packets

[Neil Dickey <neil () geol niu edu>]

Gary Flynn <flynngn () jmu edu> wrote to the Snort-users list:

> Edin Dizdarevic wrote:
>
> > memory is more important than CPU speed
>
> I hadn't heard this before. Does this apply only
> with stream reassembly enabled and lots of streams
> or to snort in general? Why?

My sense of it is that swapping of virtual memory on and off
the hard drive is one of the slowest operations the computer
carries out.  If you have insufficient RAM, there is a lot of
memory swapping happening, and that slows the machine down
dramatically.

This is true not only for Snort and related activities.  One
of the biggest mistakes inexperienced PC buyers make is to
get the latest and hottest CPU, and then choke it by skimping
on the RAM.  Such a machine will perform *slower* than one
with a much slower CPU and buckets of memory.

Two things not to skimp on:  RAM and disk space.  Having taken
care of them, then get the fastest CPU your remaining budget
will allow.

Just my humble opinion, of course.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users