Re: two sniffers on the same eth ifc performance impact?

From: James_T_Matthews@RAYTHEON.COM
Date: 03/27/02 

From: James_T_Matthews@RAYTHEON.COM
To: Patrick Andry <pandry@wolverinefreight.ca>
Date: Wed, 27 Mar 2002 15:29:03 -0500

Snort also has the capability to save tcpdump files on the fly.

Patrick Andry <pandry@wolverinefreight.ca> on 03/27/2002 02:06:17 PM
                                                                           
                                                                           
                                                                           

                                                              
                                                              
                                                              
 To:
                                                              
 cc: focus-ids@securityfocus.com(bcc: James T
          Matthews/STP/Raytheon/US)
                                                              
                                                              
                                                              
 Subject: Re: two sniffers on the same eth ifc performance
          impact?
                                                              

What about just saving the tcpdump to file and piping output to snort.
That should take care of much of the problems associated with two
programs fighting for the same nic. IIRC, you can set tcpdump to grab
the entire packet if necessary. Just make sure you have fast disks and
loads of ram.

o00o_j wrote:

> This may not be possible, and it's a very straightforward approach, but
> what about throwing a second NIC on the host and connecting both NIC's
> to a hub along with the uplink, that way you have two interfaces seeing
> the same traffic and you can avoid the problem of packet drops at the
> NIC... of course you could run into other performance problems, but
> they wouldn't be at the NIC-level.
>
> regards,
> -j
>
> --- Anton Chuvakin <anton@chuvakin.org> wrote:
>
>>Hi all,
>>
>>Just a quick question - I was not able to find an answer anywhere,
>>and my
>>thinking process somehow doesn't lead me to an answer this time ;-)
>>
>>What is the performance impact of running two sniffers on the same
>>eth0
>>interface in UNIX/Linux. For example, for whatever weird reason I
>>want to
>>run two snorts or snort and tcpdump? Will it influence the packet
>>drop
>>rates? My problem is that I can test it in low traffic environment
>>only
>>and it will have to be deployed in high-traffic one ;-(
>>
>>Thanks a lot in advance!
>>
>>Best,
>>--
>> Anton A. Chuvakin, Ph.D.
>> http://www.chuvakin.org
>> http://www.info-secure.org
>>
>>
>>
>
>
> __________________________________________________
> Do You Yahoo!?
> Yahoo! Movies - coverage of the 74th Academy Awards

®
> http://movies.yahoo.com/
>

Relevant Pages

  • Re: two sniffers on the same eth ifc performance impact?
    ... What about just saving the tcpdump to file and piping output to snort. ... the entire packet if necessary. ... > Do You Yahoo!? ...
    (Focus-IDS)
  • Re: how to sniff marked packets by iptables
    ... The MARK target _associates_ a mark with the packet in the kernel data ... the packet itself is not modified. ... tcpdump and ethereal only see the packages as they come in / go out ... datastructures are available to the sniffers. ...
    (Debian-User)
  • RE: Slickest way to capture all packets inbound and outbound for a specific IP address, or range?
    ... You could run snort in tcpdump modethen do a tcpdump on the snort log ... outbound for a specific IP address or range of IP addresses would be? ... - Precisely Define and Implement Network Security ...
    (Security-Basics)
  • Re: Snort producing tcpdump unreadable binary files.
    ... You should actually be using "snort -r" to read the files and not "tcpdump ... > had to do with RedHat Linux machines, and the fact that they changed ... > Any advice will be greatly appreciated, as I am currently logging in ...
    (FreeBSD-Security)
  • Re: packet capture
    ... >Subject: Re: packet capture ... >I agree tcpdump -w somefile is great. ... >format, so you can process it later with tcpdump, snort, ngrep, or ... >Then snort for analyzing the packets (okay tcpdump does this too, ...
    (Security-Basics)