Hi
I have some trouble with snort and download single file (Snort IPS)
When my download exides 60-63 Mbit/s, snort use 100% cpu, and it take a cople of minutes to log in to clearos box (too busy)
Shuting down snort give me 75 Mbit/s transfer rate on same file.
is it possible to configure snort to not monitor single hi speed downloads ?
System:
Core2duo 2.6 gHz
4 GB ram
Intel pro gbit net card
to slow cpu or too little mem ?
I have some trouble with snort and download single file (Snort IPS)
When my download exides 60-63 Mbit/s, snort use 100% cpu, and it take a cople of minutes to log in to clearos box (too busy)
Shuting down snort give me 75 Mbit/s transfer rate on same file.
is it possible to configure snort to not monitor single hi speed downloads ?
System:
Core2duo 2.6 gHz
4 GB ram
Intel pro gbit net card
to slow cpu or too little mem ?
Share this post:
Responses (5)
-
Accepted Answer
After some investigation, I found the problem, It was not only this download, but two more downloads at same time (windows updates).
so I do some more tests to find out how much CPU usage snort consume (% cpu Mbit/s)
All unnecessary prosesses stoped on clearos box.
E4700 @ 2.60GHz = 0.93%cpu Mbit/s (L2 Cache 2M)
E8400 @ 3.00GHz = 0.76%cpu Mbit/s (L2 Cache 6M) -
Accepted Answer
-
Accepted Answer
-
Accepted Answer
[root@gateway ~]# uname -r
2.6.32-431.23.3.v6.x86_64
[root@gateway ~]# lspci -k | grep Eth -A 4
00:19.0 Ethernet controller: Intel Corporation 82567LM-3 Gigabit Network Connection (rev 02)
Subsystem: Gigabyte Technology Co., Ltd Device e000
Kernel driver in use: e1000e
Kernel modules: e1000e
00:1a.0 USB controller: Intel Corporation 82801JD/DO (ICH10 Family) USB UHCI Controller #4 (rev 02)
--
01:00.0 Ethernet controller: Intel Corporation 82571EB Gigabit Ethernet Controller (rev 06)
Subsystem: Intel Corporation PRO/1000 PT Dual Port Server Adapter
Kernel driver in use: e1000e
Kernel modules: e1000e
01:00.1 Ethernet controller: Intel Corporation 82571EB Gigabit Ethernet Controller (rev 06)
Subsystem: Intel Corporation PRO/1000 PT Dual Port Server Adapter
Kernel driver in use: e1000e
Kernel modules: e1000e
02:00.0 IDE interface: JMicron Technology Corp. JMB368 IDE controller -
Accepted Answer
Please login to post a reply
You will need to be logged in to be able to post a reply. Login using the form on the right or register an account if you are new here.
Register Here »