[Snort-devel] Performance results over snort 2.6.x ?

Justin Heath justin.heath at ...2499...
Tue Jan 2 09:53:52 EST 2007

Many performance improvements have been made in the 2.6.x series. In
fact, performance improvements have been made with almost every 2.6
release. Therefore, should have the highest overall

That being said, there have also been many improvements in detection
as well. This extra detection capability sometimes hides the fact that
performance has been improved elsewhere. Also, as mor and more rules
are added to Snort this also decreases the performance.

The functional performance is highly dependent on your configuration
(global config, preproc configs, enabled rules etc.) and what type of
traffic you are monitoring. From my experience no two sites are alike.
In other words, your mileage may vary.


On 12/30/06, rmkml <rmkml at ...879...> wrote:
> Hi Snorter,
> Anyone have tested gain performance with snort v2.6.x ?
> (compared to snort v2.4.5)
> Important Memory diff use on snort 26/24 :
>   26 default use ~500Mo-600Mo (with my commercial rules,notVRT)
>   26 search-method lowmem use ~<100Mo (same rules)
>   24 default use ~<100Mo (same rules)
> Regards
> Rmkml
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

More information about the Snort-devel mailing list