snort-users May 2009 archive
Main Archive Page > Month Archives  > snort-users archives
snort-users: Re: [Snort-users] snort and TNAPI

Re: [Snort-users] snort and TNAPI

From: Jason Wallace <jason.r.wallace_at_nospam>
Date: Wed May 20 2009 - 20:15:34 GMT
To: Snort <snort-users@lists.sourceforge.net>


I used PF_Ring (without TNAPI) with snort about 2 years ago. I did some testing comparing it to Phil Wood's libpcap and regular libpcap. I wasn't impressed with the capture performance of PF_Ring (on x86). It is really good at capturing very small packets (better than the other two libpcaps), so it is great for things like ntop. Most of the stats you see listed on the site are for 64 byte packets. With snort the snap length is pretty high (at least for me) > 512 bytes. Supposedly it works better on amd64 systems. I have not used PF_RING+TNAPI though.

Wally

On Wed, May 20, 2009 at 2:20 PM, Ritter, Nicholas <Nicholas.Ritter@americantv.com> wrote:
> Has anyone started using snort with pf_ring/TNAPI, or have any opinion on
> the subject?
>
>
>
> TNAPI info: http://www.ntop.org/TNAPI.html
>
>
>
>
>
> Nick
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables
> unlimited royalty-free distribution of the report engine
> for externally facing server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>



Crystal Reports - New Free Runtime and 30 Day Trial Check out the new simplified licensing option that enables unlimited royalty-free distribution of the report engine for externally facing server and web deployment. http://p.sf.net/sfu/businessobjects

Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users