[Snort-devel] Re: [Snort-users] regarding Snort design.

Erek Adams erek at ...105...
Mon Apr 22 21:44:02 EDT 2002

On Tue, 23 Apr 2002, Ashley Thomas wrote:

> Will it be correct to tell that most of the work is being done at the
> snort pre processors ? If anyone can make a **crude** assumtion on the
> percentage of work (in terms of processing time) done at preprocessor
> level....
> (Assuming we load all the preprocessors: frag2,stream4,stream4_reassembly,
> portscan,http_decode etc)

Ashley, I'm not a coder--I've just futzed with this for quite a bit.  :)  So
please take my words with a grain of salt.

The main work is done in the pattern matching of the rulesets.  If your
$HOME_NET is set to a 'large' number of 'nets you are by far better off
running multi snort instances than a combined $HOME_NET.

I'm adding the developers list to the CC: so that someone more clueful than
myself can speak up, if I'm completely crackheaded.


Erek Adams

More information about the Snort-devel mailing list