[Snort-devel] Re: [Snort-users] regarding Snort design.
erek at ...105...
Mon Apr 22 21:44:02 EDT 2002
On Tue, 23 Apr 2002, Ashley Thomas wrote:
> Will it be correct to tell that most of the work is being done at the
> snort pre processors ? If anyone can make a **crude** assumtion on the
> percentage of work (in terms of processing time) done at preprocessor
> (Assuming we load all the preprocessors: frag2,stream4,stream4_reassembly,
> portscan,http_decode etc)
Ashley, I'm not a coder--I've just futzed with this for quite a bit. :) So
please take my words with a grain of salt.
The main work is done in the pattern matching of the rulesets. If your
$HOME_NET is set to a 'large' number of 'nets you are by far better off
running multi snort instances than a combined $HOME_NET.
I'm adding the developers list to the CC: so that someone more clueful than
myself can speak up, if I'm completely crackheaded.
More information about the Snort-devel