Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 24 May 2004 13:01:14 +0300
From:      Sergey Lyubka <devnull@uptsoft.com>
To:        freebsd-hackers@freebsd.org
Subject:   5.2.1 + snort, dropping packets
Message-ID:  <20040524130114.A20460@oasis.uptsoft.com>
Resent-Message-ID: <200405241449.i4OEnZ802806@oasis.uptsoft.com>

next in thread | raw e-mail | index | archive | help
hackers,
I am running snort on 5.2.1-RELEASE, and I am getting high
dropped packets rate. traffic is quiet, about 1kpps, the box runs on xeon
processor, intel gigabit NICs (em driver), system load is low:

CPU states:  1.9% user,  5.1% nice,  1.6% system,  4.7% interrupt, 86.8% idle
Mem: 121M Active, 97M Inact, 75M Wired, 736K Cache, 60M Buf, 201M Free
Swap: 512M Total, 512M Free


I have tried:
	o both SMP and UP kernels
	o both SCHED_ULE and SCHED_4BSD options
	o libpcap libs versions 0.7 and 0.8.3
	o 5.2.1-RELEASE and -current kernels
	o DEVICE_POLLING option
	o sysctl debug.bpf_bufsize set to maximum of 524288

and still having dropped packets.
I am having a much lower spec box, running obsd 3.2, same snort configuration,
capturing the same traffic. obsd shows constant 0 dropped packets.

How would I fix that problem?

_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040524130114.A20460>