[Snort-devel] Order of rule options

Robin Sommer robin at ...1526...
Sat Sep 7 04:26:02 EDT 2002


On Mon, Aug 12, 2002 at 09:30 -0400, Chris Green wrote:

> Robin Sommer <robin at ...1275...> writes:
> 
> > Speeding Up Rules That Have Content Options   
[...] 
> Reordering them would result in a small performance gain. Long term,
> as we make things such as Fisk's setwise stuff work correctly, it
> shouldn't matter.

[Sorry for the late reply; I've been busy traveling and moving]

I am not sure that it does not matter. I've done some experiments
with Fisk's code turned on [1]. In fact, I originally discovered
that the order of options does indeed matter during these
measurements. For some input traces, the setwise version is
significanlty *slower* than the version using individual matching.

Robin

[1] I am aware that it's a bit buggy. Do intend to fix it? If so, do
you already know when this is going to happen?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20020907/7bd58a76/attachment.sig>


More information about the Snort-devel mailing list