[Snort-users] Snort performance concerns

I enabled Performance Monitor on my sensors and I have some concerns after 
looking at some of the performance stats. First, I have three sensors, two of 
which average 96mb/sec of traffic and the dropped packets percentage average is 
about 10% (proc and memory utilization are high, as expected). I have a third 
sensor that sees an average of about 5mb/sec and has the same amount of dropped 
packets, memory and proc utilization are minimal. I have implemented all the 
suggested optimizations (I think), patched Libpcap, etc?.I can understand that 
there would be some dropped packets when the traffic is at a high, continuous 
load, but the third sensor with the same amount of dropped packets with only a 
fraction of the traffic  concerns me.  I am thinking about upgrading the 
hardware (faster proc, bus speeds, etc?), but I might be wasting money if the 
stats are the same.  Does anyone have any input as to what is causing the 
dropped packets? 

Also, my boss told me to start evaluating commercial products. My first choice 
would be Sourcfire, I really do like working with Snort, but I need whatever 
product I choose to be able to handle the amount of traffic that we have. I 
would greatly appreciate any input on this. Cheers.

 

Larry