Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: [Snort-users] Snort 2.6.1.3 ignoring stream4 |
|---|---|
| Date: | Fri, 6 Apr 2007 14:23:01 -0400 |
Just a question, we'll have to look at this more intensly, but try config detection: search-method ac-bnfa
Adam & Joel, I made this change on the affected sensor last night and I am now seeing packet drop% peaks in the 55-60 range, almost double where it was before. Additionally, CPU utilization for that process climbed up to 100% this morning (with the start of business) and hasn't dipped below 90%. It is typically in the 60-80% range during business hours. Previously, there was no uncommented 'config detection' line in the snort.conf file. So I've removed that change and am back to where things were when I first posted. If it matters, the sensor is on RHEL4 on x86 and had very small load on the same hardware with 2.6.0 and prior. Thanks, PaulM ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
| Previous by Date: | Re: [Snort-users] Snort 2.6 working with Snortsam, Redhat and a Cisco ASA, Joel Esler |
|---|---|
| Next by Date: | Re: [Snort-users] Snort 2.6.1.3 ignoring stream4, Joel Esler |
| Previous by Thread: | Re: [Snort-users] Snort 2.6.1.3 ignoring stream4, Joel Esler |
| Next by Thread: | Re: [Snort-users] Snort 2.6.1.3 ignoring stream4, Joel Esler |
| Indexes: | [Date] [Thread] [Top] [All Lists] |