[Snort-users] ip ranges & perfomance

Edwin Eefting edwin at ...2758...
Tue Oct 23 02:52:02 EDT 2001


Is it correct that the cpuload increases with the number of ip adresses? 
Normally I use 213.136.0.0/19 for my homenet. It then has aprox. 50% load. But
when I add only one ip (like 1.2.3.4/32), the CPU load jumps to 100%. 

Why is this? Is every iprange checked against all the rules? (e.g. double the
number of ranges, and the load will also double)

--			      __________________
			     /\ ___/	      
Edwin Eefting		    /- \ _/  Business Internet Trends BV
			   /--- \/	     __________________






More information about the Snort-users mailing list