[Snort-inline-users] improving snort-clamav performance

[Roman G. <sl...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hallo. i have here dualcore p4 prescott server with 2.6 ghz.

I get 20mbit/s performance with snort_inline 2.6.1.2-Beta1 + 2k rules

again :
  pcre-7.0  
libnetfilter_queue-0.0.13
libdnet-1.11
libnfnetlink-0.0.25.tar.bz2
clamav-0.88.5



are selfcompiled with def flags.

snort_inline was compiled with:
 ./configure --enable-nfnetlink --enable-queue
- --enable-linux-smp-stats --enable-perfprofiling
- --with-libipq-includes=/usr/local/include/ --enable-clamav



i still have the limit of 1024 packet for the nfqueue.


buffers are set to:
net.core.rmem_default = 8388608
net.core.wmem_default = 109568

and the config is :
atached + rules i am using.

It would be cool to be able to get 10mbit/s more :)

i am using default debian etch smp kernel 2.6.18-4


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIVAwUBRhuiFLhQu20hGMIkAQKMbQ//QYS4KKvsWcZVsP+/R/qyY+1GIpIyVQfS
Mgf2qxnybe7/KU0FU+uN6UsJzc+VMiBsjZR4wnVD/XJsH4uRe5hCCcjMofcVP0qh
CNl+qWg+y4hPyp400OXuSxEx7peM4HZi1AtoqzHbGz65XVqyrWhhexUAWGHJTD8P
783TjgD63mIKsAEqYfd45CubO+6Fanj2DeArpV7yh0i+4UpV8JBBD54CBepioxEI
SHZaeFSVJtLXH9j2pi/sgpY8AIJCLKfvsIuEQ1dD48nodlEIY9KBK6P24K9hYjzS
JlhnAFQtp6FB31J2WgZl69mELSsplW7cIoHyjoPWAmi0EoTXW5rlBwSKDLfjNqfZ
Xbbk1cr5oMXPMSZVt2utbNiGdXrP9pxZwZ3mzn640R5Y2J+/1/juMVrtpFN8yq+O
ditqQx1ciBLKOjkdBcnO/QJeWRgfMNWy6sNgWxnbS3qOB/09HCIksKug0VFAzq1E
30G6mrc21Dnb5YGRxvFLGMArD4MIdbGihLCRUPVSDAatkrhfBFsb7BxTgQlS9X1t
XvsPWnNy3ZFdfgvU5x9gtXuHDWP87pL5daVuxlfTkicbQjR/ISKPTzz4RZEw/NGR
aDyqVhHBDlWR5GZCKermtIen5/yR99eC1avhvDenBP9MSCjoRajrypzvARybv2n8
9hXOXtdYW2c=
=J8Iy
-----END PGP SIGNATURE-----