[Snort-devel] Performance results over snort 2.6.x ?

Justin Heath justin.heath at ...2499...
Tue Jan 2 09:53:52 EST 2007


Many performance improvements have been made in the 2.6.x series. In
fact, performance improvements have been made with almost every 2.6
release. Therefore, 2.6.1.2 should have the highest overall
performance.

That being said, there have also been many improvements in detection
as well. This extra detection capability sometimes hides the fact that
performance has been improved elsewhere. Also, as mor and more rules
are added to Snort this also decreases the performance.

The functional performance is highly dependent on your configuration
(global config, preproc configs, enabled rules etc.) and what type of
traffic you are monitoring. From my experience no two sites are alike.
In other words, your mileage may vary.


Cheers,
Justin


On 12/30/06, rmkml <rmkml at ...879...> wrote:
> Hi Snorter,
> Anyone have tested gain performance with snort v2.6.x ?
> (compared to snort v2.4.5)
> Important Memory diff use on snort 26/24 :
>   26 default use ~500Mo-600Mo (with my commercial rules,notVRT)
>   26 search-method lowmem use ~<100Mo (same rules)
>   24 default use ~<100Mo (same rules)
> Regards
> Rmkml
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>




More information about the Snort-devel mailing list