[Snort-devel] 答复: Could anyone share the performance data of Snort3.0 IDS

Nacht Z NachtZ at ...3347...
Tue Jan 10 20:00:36 EST 2017


     I have test snort 2.9 (single thread<https://www.baidu.com/link?url=Ea0YoWq6PsFZrq9UfDyj4Iq6WOGiUCq0I-SCMDmRf8Yt3jjnf8xfCHrtCCoVaLCcWd5CJtvHu9uCqC9xWGa0X2PPdLMANw_G7PWZBhfcgkYfTB9YU8tHop0mr__InFN0&wd=&eqid=b92040c8000355af0000000458757e96>, with CPU Intel(R) Xeon(R) CPU E5-2640 v2 @ 2.00GHz) with 1900 rules. It can only handle flow less than 300Mbps. So if the snort does not change it's way to analyse packets in snort 3, it may be hard to reach 10Gbps in multi-thread snort 3.0.

     What's more, one of my mate told me that he found http_inspector couldn't work in snort 3.0.0-a4. So I'm afraid that if you want to use the alpha snort 3, you may need to test it's functions.



发件人: Sunyi LIu <sunnysunny128 at ...1389...>
发送时间: 2017年1月10日 16:56
收件人: snort-devel at lists.sourceforge.net
主题: [Snort-devel] Could anyone share the performance data of Snort3.0 IDS

  We are working on a 10Gbps IDS plan, could anyone share the performance data of Snort3.0 in IDS mode . Let's say we have such as 1000 rules .
And we could fingure out if we can make good use of Snort3.0.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20170111/fcbda3b5/attachment.html>

More information about the Snort-devel mailing list