|
Home > Archive > Snort > October 2005 > [Snort-users] Performance stats
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
[Snort-users] Performance stats
|
|
| sekure 2005-10-02, 5:48 pm |
| I was wondering if someone could elaborate on the differences between
the application layer and wire counters in Snort stats. Why would i
sometimes see almost twice the application layer throughput in Mbps
than on the wire?
-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
| |
| Jason Brvenik 2005-10-02, 8:48 pm |
| The application layer stats include the reassembled traffic. It is not
unusual to see nearly double the number for app layer since snort
inspects both reassembled and raw data. The exact ratio will depend on
the mix of TCP/UDP/ICMP traffic as well as average packet sizes and rate.
sekure wrote:
> I was wondering if someone could elaborate on the differences between
> the application layer and wire counters in Snort stats. Why would i
> sometimes see almost twice the application layer throughput in Mbps
> than on the wire?
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by:
> Power Architecture Resource Center: Free content, downloads, discussions,
> and more. http://solutions.newsforge.com/ibmarch.tmpl
> ________________________________________
_______
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists...nfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=ort-users
>
-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
|
|
|
|
|