[Snort-users] Snort Performance Issues

Brian Caswell bmc at ...312...
Fri Aug 11 09:00:12 EDT 2000


Fabio Pietrosanti wrote:
> There's some mathematical operation to calculate the calculation power for
> snort?
> Something like :
> NRules * NTrafficToAnalyze or  similar ?

No, that wouldn't be very useful.  Many snort rules require looking at
packet
payload, or parsing through a preprocessor.  Any of these types of rules
would
add an enormous amount of time (comparatively) to the rules where only
the 
tcp flags are checked.  Because of the variety of rule sets available,
such an
equation would be huge. 

-- 
Brian Caswell
The MITRE Corporation





More information about the Snort-users mailing list