[Snort-devel] Re: Try This

Chris Green cmg at ...402...
Sat Apr 6 08:31:04 EST 2002


Phil Wood <cpw at ...86...> writes:

> Onward And Upward, Strive Regardless, Remember To Hang By Your Thumbs,
> Write If You Get Work,  and so on.
>
> Way to go on getting Mike's pattern matching stuff integrated.  Any known
> problems with that at this time?
>

Not that I've run into though it's only recieved cursory testing.  We
talked for a bit and he pointed out that DebugMessage wasn't being
inlined correctly like we thought and was killing his performance on
his first patch submission

The only real class of bugs that his code so far were allocs instead
of callocs

Marty's been playing with removing the recursive nature of the engine
and his initial tests with that were pretty good on OS X though he was
getting slightly different alerts and figuring out what was different
needs to be investigated

If that goes well, we're prolly going to go edit all the plugins to be
be return FALSE, NEXT, ...  so that stack pounding isn't done all the
time.

The next set of quick fixes is to start sorting the options lists so
easy checks are done first and contents are torwards the end.  Thats
the major stuff we're playing with the 1.9 series ( and getting the
few new files hanging out in the source tree working ).

I'm actually really excited because we've got a lot of people working
on Snort-related stuff (both the GPL'd stuff and our OpenSnort
products) here at Sourcefire and we're also getting some awesome
contributions integrated from the snort community.

The only thing that is hard sometimes is explaining how we have to do
bug triage to prioritize what we have to work on/patch because we have
a nearly endless task list :-)
-- 
Chris Green <cmg at ...402...>
Don't use a big word where a diminutive one will suffice.




More information about the Snort-devel mailing list