Re: [Snort-inline-users] bottle neck problem with bridge ?

[Victor J. <vi...@nk...>]

Hi Thanasin,

The clamav preprocessor might be a bottleneck. Can you try to disable it
and see if the throughput increases? I believe the Clamav-scanning is very
cpu-intensive...

Regards,
Victor


> i've use MRTG to graph my network traffic and the snmp show my bridge
> interface's speed only 10 Mbps while my NICs are 100 Mbps.
>
> Is this the real speed that i should get ?
> That's why i'm not sure that it will cause bottle neck problem or not.
>
> Regard,
> Thanasin Jitkaew
>
>>>Running snort-inline with bridge mode will drop my traffic from 100 to
>>>10Mbps ?
>>
>> latency is directly relational to the speed of your hardware and the
>> amount of network traffic  passing through the inline box.  So, the
>> answer to your question is that it depends.  Passing through ip_queue
>> will not automatically drop your connection to 10mbs.
>>
>> Regards,
>>
>> Will
>>
>> On Sun, 9 Jan 2005 23:28:51 +0700 (ICT), tha...@gb...
>> <tha...@gb...> wrote:
>>> i have installed snort-inline with clamav support to protect my network
>>> from anomally things and it's work terrific for me :)
>>>
>>> the computer that i installed snort-inline is running in bridge mode.
>>>
>>> i've a question about running in bridge mode.
>>>
>>> Running snort-inline with bridge mode will drop my traffic from 100 to
>>> 10Mbps ?
>>>
>>> if the answer is "yes". What should i do to prevent bottle neck problem
>>> that will happen ?
>>>
>>> Thank you in advance.
>>>
>>> Thanasin Jitkaew
>>>
>>> -------------------------------------------------------
>>> The SF.Net email is sponsored by: Beat the post-holiday blues
>>> Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
>>> It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
>>> _______________________________________________
>>> Snort-inline-users mailing list
>>> Sno...@li...
>>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>>
>>
>>
>> -------------------------------------------------------
>> The SF.Net email is sponsored by: Beat the post-holiday blues
>> Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
>> It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
>> _______________________________________________
>> Snort-inline-users mailing list
>> Sno...@li...
>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>
>
>
>
>
> -------------------------------------------------------
> The SF.Net email is sponsored by: Beat the post-holiday blues
> Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
> It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>