Cody,
Try running a large pcap through both snort versions and check the packet
counts. If you notice a difference in the number of packet try recompiling
with fno-strict-aliasing.
Cheers,
Justin
On 10/30/06, Cody Holland <cholland@redmooninc.net> wrote:
Ok, I am in the process of replacing one of my sensors with a 2.6.xsensor.
The old one, running 2.4.x, is still in place. I've setup two monitor
ports
on our cisco switch so both are running at the same time. I've noticed two
things that are concerning me.
1. I'm just running snort in verbose mode, snort -i fxp1 -v, and
compairing
results. The 2.6.x server is showing far fewer hits that the old one.
2. The new server is also getting a lot of Not IPv4 datagram! entries.
I have attached a log file from each of the servers. I'm also digging
around
on google and the forums and am getting some info, but if anyone out there
has any input, it would greatly be appreciated.
Cody
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
