[Snort-sigs] Snort faster with rules containing a lot of content parameters

Carl Nykvist nykvistc at gmail.com
Wed May 1 05:22:08 EDT 2019


Hi!

Me and a friend is doing a project with some testing, and we see that Snort
has higher throughput(Packets/second) when the number of rules with content
parameter increases, and when the number of rules with content parameter
are very few, Snort has very low throughput.

Does anyone know the reason for this?

Regards,
Carl
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20190501/4e3e200f/attachment.html>


More information about the Snort-sigs mailing list