Date: Mon, 24 May 2004 13:01:14 +0300 From: Sergey Lyubka <devnull@uptsoft.com> To: freebsd-hackers@freebsd.org Subject: 5.2.1 + snort, dropping packets Message-ID: <20040524130114.A20460@oasis.uptsoft.com>
next in thread | raw e-mail | index | archive | help
hackers, I am running snort on 5.2.1-RELEASE, and I am getting high dropped packets rate. traffic is quiet, about 1kpps, the box runs on xeon processor, intel gigabit NICs (em driver), system load is low: CPU states: 1.9% user, 5.1% nice, 1.6% system, 4.7% interrupt, 86.8% idle Mem: 121M Active, 97M Inact, 75M Wired, 736K Cache, 60M Buf, 201M Free Swap: 512M Total, 512M Free I have tried: o both SMP and UP kernels o both SCHED_ULE and SCHED_4BSD options o libpcap libs versions 0.7 and 0.8.3 o 5.2.1-RELEASE and -current kernels o DEVICE_POLLING option o sysctl debug.bpf_bufsize set to maximum of 524288 and still having dropped packets. I am having a much lower spec box, running obsd 3.2, same snort configuration, capturing the same traffic. obsd shows constant 0 dropped packets. How would I fix that problem?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040524130114.A20460>