5.2.1 + snort, dropping packets
From: Sergey Lyubka (devnull_at_uptsoft.com)
Date: 05/24/04
- Previous message: Panagiotis Astithas: "Re: Freezes on heavy disk I/O"
- Next in thread: Don Bowman: "RE: 5.2.1 + snort, dropping packets"
- Maybe reply: Don Bowman: "RE: 5.2.1 + snort, dropping packets"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Mon, 24 May 2004 13:01:14 +0300 To: freebsd-hackers@freebsd.org
hackers,
I am running snort on 5.2.1-RELEASE, and I am getting high
dropped packets rate. traffic is quiet, about 1kpps, the box runs on xeon
processor, intel gigabit NICs (em driver), system load is low:
CPU states: 1.9% user, 5.1% nice, 1.6% system, 4.7% interrupt, 86.8% idle
Mem: 121M Active, 97M Inact, 75M Wired, 736K Cache, 60M Buf, 201M Free
Swap: 512M Total, 512M Free
I have tried:
o both SMP and UP kernels
o both SCHED_ULE and SCHED_4BSD options
o libpcap libs versions 0.7 and 0.8.3
o 5.2.1-RELEASE and -current kernels
o DEVICE_POLLING option
o sysctl debug.bpf_bufsize set to maximum of 524288
and still having dropped packets.
I am having a much lower spec box, running obsd 3.2, same snort configuration,
capturing the same traffic. obsd shows constant 0 dropped packets.
How would I fix that problem?
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
_______________________________________________
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
- Previous message: Panagiotis Astithas: "Re: Freezes on heavy disk I/O"
- Next in thread: Don Bowman: "RE: 5.2.1 + snort, dropping packets"
- Maybe reply: Don Bowman: "RE: 5.2.1 + snort, dropping packets"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
