Re: snort under high density traffic

[Mehmet Ersan TOPALOGLU <mersan () ceng metu edu tr>]

Edin Dizdarevic wrote:
> Hi,
>
> Mehmet Ersan TOPALOGLU wrote:
>
> > > Mehmet Ersan TOPALOGLU wrote:
>
> [...]
>
> > Yes i again take wrong statistics.
>
>
> Hm, actually that shouldn't be.
>
> I would advise you to connect the sensor and the sender with a
> crossover cable and then use tcpreplay to send out the packets.
>
> Remember the stats you get from tcpreplay.
>
> After that kill SIGUSR1 Snort and get the stats.
>
> Is there any difference then?
>
> Please post the outputs here.


i am using tcpreplay for my statistics already.

i tried cross cable and results didn't change much.
with -r 1(that is 1 mbit/sec) option of tcpreplay statistics almost 
equal tcpreplay reports 1663986 packets sent
"snort analysed 1663986 out of 1676198 packets dropping ..."

but with -r 30(30Mbit/sec) option statistics almost double :(
again same dump tcpreplay repots same but
"snort analysed 1663986 out of 3265264 packets dropping ..."



--
- mersan
    mersan () ceng metu edu tr
    mersan () metu edu tr

        Budi srecna. Meni je to dovoljno.



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users