[Snort-users] Snort 2.0 dropping packets

From: Always Bishan <bishan4u(at)yahoo.co.uk>
Date: Sun Apr 20 2003 - 03:26:27 EDT

Hi Snorters,

I have three sensors in my network.1st sensor is also the manager and runs on a AMD Athlon and 256MB RAM. 2nd sensor is on a Celeron 466Mhz with 192MB RAM machine and the 3rd on a Pentium II and 128MB RAM.

For testing purposes I ran all three sensors in the same network with same configuration.I found that all my three sensors were dropping some packets. There were unique alerts by one sensor which were missed by the other two and vica versa.

I'm running these on a HUB based network at 10MBPS and we are going to shift onto Switches within few days.

Now my problem is what shall I do to avoid this packet loss as it is going to drop more packets on a switch network.

I have heard of barnyard but never used it, can somebody enlighten me on this.

How do you implement and tackle these issues in your high speed networks.

It will be great if snort champions of this mailing list can enlighten us all with some *best Practices* and any caveats.

Regards,
Bishan

---

Celebrating Happiness
email: bishan@sumerusolutions.com
company: www.sumerusolutions.com

---

Yahoo! Plus
For a better Internet experience
http://www.yahoo.co.uk/btoffer

---

This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven.
http://thinkgeek.com/sf

---

Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users Received on Sun Apr 20 04:04:54 2003