Thanks Slarty,
Ive done 2 out of your 4 recomendations, I wasnt aware there was compile time options from preprocessors and I had only been using runtime options to improve performance. Do you have a link to info on disabling swap?

Tiger_Shark
I think its pretty well known that the pattern matching facility in snort is a major bottle neck. Ive read several papers about it but I found the white papers here to go into the best technical info about it:
http://www.ist-scampi.org/
or
http://www.ntop.org
has some info on packet capturing speeds in general

I am also running on a gigE network. Snort works fine on a 100 Mb/s network but once you exceed this with a default snort you will start dropping packets. And also snort actually reports the captured traffic incorrectly( I should report this to the devel list but Im too lazy)
When I saturate my network with about 800 Mb/s of traffic snort will hit 100% of cpu. I was getting about 80-90% packet loss with the default snort and libpcap. But with kernel level modifications (ie drastically reducing interupts) I have been able to reduce this to about 10% and I am trying to get this to 0%. My hardware is rather nice too. I have dual p4 Xeons with 2 gigs of ram running on a debian 2.6 kernel. I am using intel gigE cards with MMAP polling and NAPI enabled.

-- snip --
Snort is beautifully written to buffer the incoming packets rather efficiently in memory if it can or drop it to disk if absolutely necessary.
-- snip --
Ive been thourgh the snort code extensively lately and I cannot find anywhere where it will save packets to disk when running it in NIDS mode. Nor do I see it buffering packets anywhere in memory. From what I have determined it uses libpcap to grab the pakets and processes a single packet at a time all the way thorugh before grabbing another packet.