Re: Stream4 reassemble on all ports?

[Jeremy Hewlett <jh () sourcefire com>]

On Tue, Dec 28, Jeff McCarthy wrote:
> It looks like I can enable the Stream4 preprocessor to
> reassemble on all ports rather than just the default
> ones. Would this cause a significant strain on system
> resources and are there any other downsides to doing
> this?

Yes, this may cause a huge performance impact and cause your sensor to
start dropping packets (most definitely if you start reassembling all
server-side as well). However, this is really dependent on how beefy
your box is and how busy your link is. If your site is relatively
low-traffic, I don't see any issues with what you want to do.




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users