5.2.1 + snort, dropping packets

[Sergey Lyubka]

hackers,
I am running snort on 5.2.1-RELEASE, and I am getting high
dropped packets rate. traffic is quiet, about 1kpps, the box runs on xeon
processor, intel gigabit NICs (em driver), system load is low:

CPU states:  1.9% user,  5.1% nice,  1.6% system,  4.7% interrupt, 86.8% idle
Mem: 121M Active, 97M Inact, 75M Wired, 736K Cache, 60M Buf, 201M Free
Swap: 512M Total, 512M Free


I have tried:
	o both SMP and UP kernels
	o both SCHED_ULE and SCHED_4BSD options
	o libpcap libs versions 0.7 and 0.8.3
	o 5.2.1-RELEASE and -current kernels
	o DEVICE_POLLING option
	o sysctl debug.bpf_bufsize set to maximum of 524288

and still having dropped packets.
I am having a much lower spec box, running obsd 3.2, same snort configuration,
capturing the same traffic. obsd shows constant 0 dropped packets.

How would I fix that problem?

_______________________________________________
freebsd-hackers at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe at freebsd.org"