[Snort-devel] Order of rule options
robin at ...1526...
Sat Sep 7 04:26:02 EDT 2002
On Mon, Aug 12, 2002 at 09:30 -0400, Chris Green wrote:
> Robin Sommer <robin at ...1275...> writes:
> > Speeding Up Rules That Have Content Options
> Reordering them would result in a small performance gain. Long term,
> as we make things such as Fisk's setwise stuff work correctly, it
> shouldn't matter.
[Sorry for the late reply; I've been busy traveling and moving]
I am not sure that it does not matter. I've done some experiments
with Fisk's code turned on . In fact, I originally discovered
that the order of options does indeed matter during these
measurements. For some input traces, the setwise version is
significanlty *slower* than the version using individual matching.
 I am aware that it's a bit buggy. Do intend to fix it? If so, do
you already know when this is going to happen?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 232 bytes
Desc: not available
More information about the Snort-devel