Re: Snort + PF_RING + DAQ

[Livio Ricciulli <livio () metaflows com>]

That is definitely strange. We have not tested the latest versions of 
PFRING since it changes too quickly for us, assuming no major setbacks, 
but  you should be able to do many gigs..
Here are a few things I would look at:

o Do you have rules with long lists of IPs like [ip1,ip2,ip3,ip4...] 
etc? These types of rules are horribly slow because snort matches them 
linearly. If so, try disabling them and see if things improve (if so, 
let me know we a plugin for that). You can also configure snort with 
--enable-perfprofiling to see  if there are bad rules that are taking 
too much time.
o Does top show the processes are mostly mostly pegged in the 80%-100% 
kind of evenly?
o Could it be contention caused by barnyard? Can you try without and see 
if that helps?
o A big buffer can always help. When you load the pf_ring kernel module 
give it at least 65k and place your interfaces in transparent mode 1 as in:
transparent_mode=1 min_num_slots=65536 (or even more than 65k if your 
kernel can handle it). You might need to also increase the kernel memory 
with vmalloc=256M as a boot parameter.
o On some of our processors we got very good performance improvements by 
compiling snort with "-march=native -fomit-frame-pointer -O3"
o What does cat /proc/interrupts show? Do you map the eth* IRQs to 
different CPUs or does CPU 0 do all the interrupts?
o Then there is the snort.conf.. I will let other people chime on that..

Here are just a few I can think of right now..

Livio

On 9/4/2012 7:15 AM, Peter Bates wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Hello all
>
> I'd actually be interested in anyone's Snort tuning suggestions
> because I'm running Snort + PF_RING pretty much as per the Metaflows
> 10Gb instructions and still dropping traffic - this is with 1-2Gbps
> and about 1000 rules.
>
> Following the Metaflows route I was running 32 instances of Snort (and
> 32 x Barnyards) and the results were not encouraging.
>
> And before Joel says it, I do know you have a SF box you could sell me ;)
>
> - -- 
> Peter Bates
> Senior Computer Security Officer    Phone: +44(0)2076792049
> Information Services Division     Internal Ext: 32049
> University College London
> London WC1E 6BT
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.17 (MingW32)
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iQEcBAEBAgAGBQJQRgzpAAoJELhVoVpEMS6RFq4IAJvw+PLuCrPr536b/eQgU63+
> mcvsJLUVkt3cX9gMhqeWpolpCmqptgbqG9+hE52vvWmzuIQUC0YUEWeqsRa/hk46
> lYL+QGJoUx+LmUFM3gMfCq84GQLwUd4NN2TRBsjPoUvze6YMFmOuAI5DlPCn2Jw9
> bzZxQmNtufQyMI8jBefa/RsoU20gBgfKP3J7d5f8usOwRjJ9X/XmZ3eHoJn7bObg
> cRk+sTJiaLijsWCDHWGrkN9dbED3b5tBofJvafZhAlCHIg+zGQtaeVxmRwZeNjAD
> 2EXwTSxka1hImKs+dtkvmTrvZHz8Wg+ktqBVbzcB7j24lDpl4jVJq+8XlKqXbB8=
> =D/lX
> -----END PGP SIGNATURE-----
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!


-- 
Livio Ricciulli
MetaFlows Inc.
(408) 835-5005


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!