The best way to measure pfring performance is to compare the RX PACKET
counts from the input interface
(or your generator) with the sum of all the Tot Packets counts in the
files /proc/net/pf_ring/*eth* with the same 'Cluster Id'
These proc files are dynamically created and deleted as new processes
are added or deleted to the PFring clusters.
Anything counted in Tot Packets is also processed by Snort.
It you are after performance, you need to use the Ethernet drivers
On Feb 23, 4:55 pm, four <sur...@gmail.com> wrote:
> I've been reading your blog and following along at home. I have a
> I turned on the snort-stats preprocessor and was looking at the
> Thanks much for the blog posts!
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.