Re: snort packet loss rate

[Gulfie <gulfie () grotto-group com>]

On Wed, Apr 26, 2006 at 09:47:32AM -0400, Jin Fang wrote:
> > How much bandwidth is on that adapter? Is it really a gigabit connection, 
> > or is
> > it feeding a lower-speed line? Is the card on a PCI bus, or something 
> > faster
> > such as PCI-X or PCI-E?
>
> It is having gigabit throughput and card is on a PCI-X. 
 
        Note: 

                You really nead to check the entire traffic stack. 

        If you are using a switches span port, you'll be able to get 
snmp stats from the port to get how many packets are supposedly coming
down the line.  Comparing this to what snort says is a good first verification. 
A good second place to check is verifing that the span isn't droping frames (which they
sometimes do), by summing the snmp counters on the working ports of the switch.  Sometimes
to get good numbers you'll have to add a switch or add an extra loop or two of gige to slow
the traffic down and not get droped. 


        [ingress vlan]  =>  loop of wire => skip vlan => loop of wire [egress vlan] 

                                           ^         ^
                                           monitor here


SPAN and snmp in the skip vlan.  Idealy one of the wire loops would be an ethernet
tap. 

        Also, on linux you can use the mmaped PCAP, it's a fair amount faster. 


        

                                                        -gulfie 
 
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job 
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users