Remove it from the .conf and see the performance again
On 6/17/05, Joel Esler <eslerj@gmail.com> wrote:
could be. I made a change to the rpc processor too, but that wouldn't
cause a performance increase. interesting.
On 6/17/05, snort user <snort.user@gmail.com> wrote:
In both cases, it does exactly the same thing in the code.
and this happens when snort starts.
so i dont understand if there is a performance difference.
might be something else that is causing the performance difference
On 6/17/05, Joel Esler <eslerj@gmail.com> wrote:
I know what it does. What I am saying is, if you specify them in the
.conf file, as opposed to letting the compiled code do it, is it
faster? In my tests it's showing significant CPU performance
increase..
J
On 6/17/05, snort user <snort.user@gmail.com> wrote:
Those are the default ports for which state tracking/reassembly is
done
if you dont specify anything in the snort.conf
# ports [list] - use the space separated list of ports in [list],
"all"
# will turn on reassembly for all ports, "default"
will turn
# on reassembly for ports 21, 23, 25, 53, 80, 143,
110, 111
# and 513
On 6/17/05, Joel Esler <eslerj@gmail.com> wrote:
Has anyone else noticed a significant performance increase by
specifying the ports for stream4?
If I look at the code for stream 4, take the ports that are in
there.
and specify them via the snort.conf
ports: < 21 23 25 53 42 80 110 111 143 513 >....etc..
It is SO much faster and doesn't consume as much CPU resources...
anyone?
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration
Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&opclick
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?listsnort-users
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&opclick
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?listsnort-users
--
Mohamed Eldesoky
www.eldesoky.net
RHCE
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&opÌk
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
