On Sat, Mar 03, 2012 at 09:14:51PM +0100, Jaime Nebrera wrote: > Hi Justin, > > I believe the idea is to reduce the load on snort when you know it going to > drop a packet > That is, snort receives a stream until decides it's a drop. Further packets > in that flow will be dropped directly at pfring layer (or even at hardware > layer if you are lucky and own a card that supports hardware filters) > > This of course makes snort see less packets, and thus allows snort more > room for extra traffic
The problems being that * Snort is not running inline so it isn't actually dropping packets * Other things are running on the box that need to see all the packets * The feature does not appear to even work anyway, over time the majority of the traffic ends up being dropped. 4/5ths of our traffic is definitely not alert traffic, so I'm not really sure what was being dropped. Is there a way to print out the current pf_ring filter? so.. bug of feature, I think this needs to be an option that you can turn off. Even if it worked 100% correctly, it would still break the other apps running on the box. -- -- Justin Azoff -- Network Security & Performance Analyst _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
