Hi all
we have made a patch to PF_RING DAQ. Please update and let us know if it
works now. Note that we have also updated the README file under the same
directory to explain all the options.
Thanks Luca
On 03/04/2012 08:00 AM, Jaime Nebrera wrote:
Hi Justin,
I agree with you this should be configurable but is still valid in IDS mode
Your problem is not the fact you are running as IDS but that other apps require
to see that traffic
Enviado desde mi iPhone
El 03/03/2012, a las 22:17, Justin Azoff<[email protected]> escribió:
On Sat, Mar 03, 2012 at 09:14:51PM +0100, Jaime Nebrera wrote:
Hi Justin,
I believe the idea is to reduce the load on snort when you know it going to
drop a packet
That is, snort receives a stream until decides it's a drop. Further packets
in that flow will be dropped directly at pfring layer (or even at hardware
layer if you are lucky and own a card that supports hardware filters)
This of course makes snort see less packets, and thus allows snort more room
for extra traffic
The problems being that
* Snort is not running inline so it isn't actually dropping packets
* Other things are running on the box that need to see all the packets
* The feature does not appear to even work anyway, over time the
majority of the traffic ends up being dropped.
4/5ths of our traffic is definitely not alert traffic, so I'm not really
sure what was being dropped. Is there a way to print out the current
pf_ring filter?
so.. bug of feature, I think this needs to be an option that you can
turn off. Even if it worked 100% correctly, it would still break the
other apps running on the box.
--
-- Justin Azoff
-- Network Security& Performance Analyst
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
