[Oisf-devel] Performance Boosts

[Victor Julien]

On 03/23/2012 04:05 PM, Brant Wells wrote:
> I got a 50mbit fiber line (50 up and 50 down) that is usually just
> running around 40mbit down.  My box is currently on a Mirror port (SPAN
> port for the cisco guys out there).
> 
> Other pertinent info, I am also running OpenFPC on this box as well for
> network capture to (a second) disk.  Could that be affecting Suricata
> (ie: Should I start Suricata first, and then start the network capture,
> or does it matter?
> 
> I just got Suri fired back up again, so I'll see what happens...
> 
>   One final thought... I did an upgrade on my Firewall last night...  It
> now has a better ability to block P2P traffic and such...  If the
> firewall is blocking the P2P, that means suricata isn't having to
> process quite as large of a volume of packets...  Could that be where
> all of my CPU usage went?

Might play a role, although you should be able to tell by looking at
your stats and p2p alerts :)

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------