Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort
Snort News Downloads Snort Docs Rules Snort Community Snort Forums Snort Training
Search Site
Search Rules
Account
email
password
not registered?
user preferences

Snort Forums Archive

Archive Home » Snort Newbies » How about snort's performance? Does it support zero-copy?

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

How about snort's performance? Does it support zero-copy?


Posted by touch on March 14, 2005 22:28:43

I want to deploy some IDS systems in a switch ethernet with 100M bandwidth. I want it to detect all the packages on line. Can snort work well in this situation? (I am sorry I can't install a snort to test now in that network. I ask so that anyone can give me some description about snort's performance or some "stories" about it :-) )

I know if I want to take advantage of the "zero-copy" technology. I should modify the driver of the ethernet card. I think snort would not support "zero-copy"(because it does not need such a special kind of driver). Is is right? I'm worrying about that it would take a high overhead in the situation of high flow......

Can anyone give me any information about the performance of snort? any help are appreciated!
site feedback | Terms of Use | Privacy Policy | forum archives ©2008 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.