-1

I am thinking about setting up snort to act as an intrusion detection system on a machine running debian that I use as a router. Snort would be listening on the internet side (not really any significant risks, more or less just seeing what sort of activity occurs). Both of the ethernet adapters support gigabit connections (one adapter is built into the mother board while another is in an expansion slot) and the internet connection itself is about 100Mpbs (a rough estimate based on how fast I can transfer data from remote machines, this connection is inside a college dormroom). Other than occasional large file transfers (usually around one or two GB) the connection is mainly just used for browsing the web, outgoing ssh connections, etc, so there is not usually too much traffic flowing through. The machine itself is a dell optiplex 755 with a core2duo processor. Having said all of that, I was wondering if putting the nic that is connected to the internet, in promiscuous mode would cause latency to increase by a significant amount? I had done a small test and pinged a website while turning promiscuous mode on and off, and did not notice any difference in the ping times (was in ms). Also do the capabilities of the cpu affect how much latency is introduced when an interface is in promiscuous mode? Thanks for your help!

Improve this question
8
  • Try it and see. Report back on your findings!
    – ewwhite
    Jan 30, 2013 at 3:34
  • I don't understand your topology. If the traffic is flowing through the device, why would promiscuous mode make a difference? It has to handle the traffic anyway. And if the traffic isn't flowing through it, why would promiscuous mode make a difference? It's not going to see the traffic anyway unless you have a switch that supports port mirroring or something like that.
    – David Schwartz
    Jan 30, 2013 at 3:38
  • @DavidSchwartz so since snort would be listening to the internet "side", it would not really make any difference whether or not I have promiscuous mode on since I would only be able to see traffic that is meant for my machine in the first place? sorry for the dumb questions, have not used snort for this type of thing before
    – lacrosse1991
    Jan 30, 2013 at 3:58
  • @lacrosse1991: The machine already sees all the traffic it routes.
    – David Schwartz
    Jan 30, 2013 at 3:59
  • @DavidSchwartz ok thanks! sort of going off topic, but if I wanted snort to monitor the traffic on the internal network, how would that work? Reason that I ask is because wouldn't the machines be talking directly to each other through the switch instead of going through the router for everything? (im assuming that port mirroring/span ports only mirror one connection on switches although I could be wrong)
    – lacrosse1991
    Jan 30, 2013 at 4:18

1 Answer 1

Reset to default
1

As all the traffic you are interested is IP and routed, I see no benefit in turning on the promisc mode on the interface.

Because you should not expect any traffic that is not addressed to your NIC (I assume that your ISP is using a L2 bridge or router) to be on the wire, you will see not difference in the traffic captured.

However if you would have a lot of traffic that does not have as destination your router or that is not broadcast, the traffic will be processed by the Linux kernel and, after they are processed by pcap, they will be discarded. This will increase the number of interrupts/s for the NICwith potential impact on the performance. This can be mitigated by enabling packet coalescing on the NIC.

Improve this answer
3
  • thanks for the info! was not aware of the packet coalescing thing, is that something that is built into the nic itself, or is that something that the os handles?
    – lacrosse1991
    Jan 30, 2013 at 6:56
  • also would that have anything to tcp offloading? this machine does not have it afaik, although I have a ibm x3650 (use it for file processing as well as a few other things) which does
    – lacrosse1991
    Jan 30, 2013 at 6:58
  • Packet coalescing is implemented in the NIC part in the hardware and part in the driver. TCP offloading engine is not the same as interupt coalescing. The effect is similar - less interrupts and more work offloaded from CPU to NIC, but the mechanisms are independent. Sometimes you might need to disable it to see the real packets. Disabling TOE will increase the load on the CPU. Check the CPU usage in kernel space (system) and the interrupts rate before and after the changes. Use dstat for monitoring.
    – Mircea Vutcovici
    Jan 30, 2013 at 16:03

Not the answer you're looking for? Browse other questions tagged .