Re: Issues running snort 3 in multi threaded mode.
Andrew Welham <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
Hi, Shame i'm trying to route on a new 1GB internet connection with major performance issues in snort I did have a thought though, If i have multiple networks, some with internet facing servers. These obviously need IPS in both directions. For clients (pcs) as there are no inbound connections connection, is it a reasonable options to only test outbound traffic, to catch bad connection etc, but not inbound, as there are no inbound triggered connections allowed. This also helps as the performance issues are caused by inbound traffic to the clients? Thanks On 30/03/2022 08:01, Fatih USTA wrote: > Hi > > Snort3 doesn't support multi thread with nfq mod. > > I asked same question before. > > https://github.com/snort3/snort3/issues/164#issuecomment-804597085 > > > Fatih USTA > > On 30.03.2022 09:03, Andrew Welham wrote: >> Dear All, >> >> I'm trying to run snort 3 in multi threaded mode. As i only appear to >> have a single thread with maxes out at 100% cpu utilisation, when >> other cores in the servers are not utilised. >> I am running using NFQUEUE as i also have a firewall on the same router. >> >> I added -z 4 to the command i use. >> >> /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k >> none -l /var/log/snort -D -m 0x1b -Q -z 4 >> >> >> Although snort launches i get the following errors, and snort while >> working does not run in multithreaded mode. >> >> nfq DAQ configured to inline. >> initializing daemon mode >> child process is 39280 >> Commencing packet processing >> # ++ [0] 0 >> ++ [1] 0 >> ++ [2] 0 >> ++ [3] 0 >> Error receiving message from the DAQ instance: nfq_daq_msg_receive: >> Netlink message processing failed: -1 - Operation not permitted (1) >> -- [1] 0 >> Error receiving message from the DAQ instance: nfq_daq_msg_receive: >> Netlink message processing failed: -1 - Operation not permitted (1) >> Error receiving message from the DAQ instance: nfq_daq_msg_receive: >> Netlink message processing failed: -1 - Operation not permitted (1) >> -- [3] 0 >> -- [2] 0 >> >> >> Is it possible to run snort 3 in multi threaded mode with NFQUEUE. >> Have i made some type of config error >> >> >> Many Thanks >> _______________________________________________ >> Snort-users mailing list >> [email protected] >> Go to this URL to change user options or unsubscribe: >> https://lists.snort.org/mailman/listinfo/snort-users >> >> To unsubscribe, send an email to: >> [email protected] >> >> Please visit http://blog.snort.org to stay current on all the latest >> Snort news! >> >> Please follow these rules: >> https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette