Re: [Snort-users] Slow custom preprocessor

If the custom preprocessor is slow in processing packets, it eventually
makes the whole snort application that you are running slow.

In that case, the snort should be dropping packets more frequently than
normal.

Did you do any measurements by increasing the traffic from a 'low' to
'high' value and check when the application starts dropping packets.

You can do the same with and without the preprocessor turned on.

cheers

On 6/2/06, Sanjai Narain <narain@research.telcordia.com> wrote:
> It is possible that my custom preprocessor is consuming packets at a
> rate slower than they are being handed to it by Snort. If this is the
> case, I would appreciate any suggestions for how to handle it. Are there
> any buffers that one can increase? I did check the Snort statistics when
> it terminates and it showed 0% packet loss. This leads me to believe
> that the custom preprocessor might be too slow, not Snort itself.
> Thanks. -- Sanjai
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users