On Thu, Mar 01, 2012 at 09:32:50AM +0100, Luca Deri wrote: > Justin > Via the pfring DAQ we inject drop rules in the kernel whenever snort > detects bad traffic. It might be that these rules are causing the > problem you see as all the rules are removed when you restart snort. > Can you please check what traffic is dropped and verify if my feelings > are correct?
I'm not sure how to figure out what traffic is actually being dropped, but I did notice this: tucker:/proc/net/pf_ring# grep 'Rules' 2*;echo;sleep 5;grep 'Rules' 2* 20568-sniff1.63:# Sw Filt. Rules : 24261 20568-sniff1.63:# Hw Filt. Rules : 0 20571-sniff1.64:# Sw Filt. Rules : 24390 20571-sniff1.64:# Hw Filt. Rules : 0 20568-sniff1.63:# Sw Filt. Rules : 24415 20568-sniff1.63:# Hw Filt. Rules : 0 20571-sniff1.64:# Sw Filt. Rules : 24528 20571-sniff1.64:# Hw Filt. Rules : 0 is that what you are referring to? I'm not sure why the daq module should do this in the first place.. especially when not running inline. -- -- Justin Azoff -- Network Security & Performance Analyst _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
