I can't explain the technical reasons why the packets are being dropped.
There are a lot of attempts to explain this if you check the mail list
archive or search google.
I can suggest a solution. Upgrade your libpcap to the mmap version. Again,
if you search on google you'll find a info on this.
I had about the same stats you have, upgraded libpcap and now I get 0%
dropped packets. That's not to say it doesn't drop any packets, but the
number is so small the stats show as 0%.
Barry
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net]On Behalf Of
hchlai@netscape.net
Sent: Thursday, January 27, 2005 2:32 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] dropping packets
I have realized that Snort has been dropping packets even I'm running it
inconjuction with Barnyard. Does anybody know what causes Snort to drop
packets? I'm running Barnyard with these options:
barnyard -c -d -g -f -s -n -w -a
and Snort with the following:
snort -c -i -g -Dv
I'm recording about 1%-2% of packets being dropped by Snort... sometimes as
high as 6%. Many thanks!
Hugo
__________________________________________________________________
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register
Netscape. Just the Net You Need.
New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
