I have a 4215, running 5.0.4-S149. In an attempt to update it to S191 (and then later S192) I noticed that packets start getting dropped, inbound and outbound, while running at that signature level. Connectionless protocols seem to work ok. However connection oriented protocols (ssh, smtp) see dropped connections after about 10 seconds or so.
The sensor sits inline between my Checkpoint firewall and 2611XM router. There is no assymetric routing going on. I don't see any new signatures getting fired off in the event viewer, however I do see an increase in 1300 and 3109.
After reading the false positive statement from cs-mars on sig 3109, it states:
"This signature may cause false positive alarms if the sensor misses certain packets in a SMTP session. This may be caused by the sensor dropping packets due to performance reasons or asymetric routing patterns in the network being monitored."
I think the sensor isn't able to keep up with the traffic when I update to that signature level. I did notice that the memory utilization went from the 48% it normally sits at to around 75-80% when at S192.
Any ideas? Does anyone know how to see if the IDS is dropping packets?
