Hi Justin, I believe the idea is to reduce the load on snort when you know it going to drop a packet
That is, snort receives a stream until decides it's a drop. Further packets in that flow will be dropped directly at pfring layer (or even at hardware layer if you are lucky and own a card that supports hardware filters) This of course makes snort see less packets, and thus allows snort more room for extra traffic This means, without it you might be able to process a stream of 500Mbps were you might drop 100. With it enable you might process a stream of up to 600 Mbps and drop those 100 at a lower layer (so snort processes the same amount of traffic) Your call, coherent info or extra performance If you don't have drop rules, this won't help you. If your traffic is very clean, neither but when things are nasty is very valuable Btw, you can get those stats at the interface level and thus have the same info Enviado desde mi iPhone El 03/03/2012, a las 20:08, Justin Azoff <[email protected]> escribió: > On Sat, Mar 03, 2012 at 07:43:00PM +0100, Jose Vila wrote: >> Back then, we thougt it was a problem with our NIC (bnx2 driver) and >> discarded PF_RING usage. If you find a solution to this problem, I >> think we will be able to retest again to see if it works better. > > In daq_pfring.c there is a block of code in a switch statement leading > up to: > > rc = pfring_handle_hash_filtering_rule(context->ring_handle, &hash_rule, 1 > /* add_rule */); > > I removed this whole section and rebuilt the daq module. That made the > problem go away. I'm not 100% sure why the daq module does this in the > first place. Bug or feature, removing it makes everything work great. > > -- > -- Justin Azoff > -- Network Security & Performance Analyst > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
