title: low snort performance in inline mode and afpacket type
body: <p>i install and config snort in inline mode in afpacket type. i test it with no rule and also test in in just one rule and more rules. but the result was same. performance of my snort is too low.</p>
  
  <p>while i use system bridge created via (brctl) i can use full network bound width and my cpu usage in about zero. </p>
  
  <p>while i use snort in passive mode (IDS) behind system bridge my cpu usage is about 60-70 percent and my network bound width is good (about 80 percent of full)  </p>
  
  <p>but while i use snort in inline mode (IPS) although the cpu usege is near the zero but my network bound width is very low and lower than 1 Mbyte. 
  i test it via (ab) like </p>
  
  <pre><code>ab -c 10 -n 10000 http://server/50kfile
  </code></pre>
  
  <p>my config is like: <a href="http://www.pastebin.ca/2688413" rel="nofollow">http://www.pastebin.ca/2688413</a> (i use (grep -v ^# | grep -v ^$) for removing comments) full config file is: <a href="http://www.pastebin.ca/2688414" rel="nofollow">http://www.pastebin.ca/2688414</a></p>
  
  <p>and i add -Q while i run snort
  i use ubuntu 12.04</p>
  
  <p>thanks for any kind of help</p>