--On 23 November 2005 11:59 +0000 "Alex Butcher, ISC/ISYS"
<Alex.Butcher@bristol.ac.uk> wrote:
The sensor is currently monitoring a single 100Mbit (pretty much solid,
24x7) feed from a SPAN port and has all rules enabled (including bleeding
and community), with a fair bit of session tagging, and is utilizing
15-30% of one CPU and 188Mbyte of memory to do so. Snort is linked
against Phil Wood's modified libpcap and configured to use the maximum
buffer size. Hopefully the CPU usage will decrease once I've had a chance
to tune the rules properly.
A quick correction; I thought my statistics were lying to me, but
apparently, the sensor has a single Gbit feed, rather than the single
100Mbit feed I was referring to in my original post above.
There is currently some packet loss, but I'm not quite sure at the moment
whether it's the switch, the sensor hardware, the sensor->console link, or
running on x86_64 that is causing this. My guess is the switch, but I've
not verified this yet.
Alex.
Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
