[Snort-users] IP Header Data Type Preference

Brian bmc at ...950...
Fri May 16 15:58:08 EDT 2003


On Fri, May 16, 2003 at 03:32:24PM -0400, David Markle wrote:
> I need some advice on IP Header Data types with a database, say MySQL.  The
> MySQL snort database defines IP address information as INT (integer) (i.e.
> ip_src/ip_dst in the iphdr table).  Is there a computational benefit to this
> within the database or does it really matter.

It is *MUCH* more efficient to store it as an integer than as a text
string.  It is the only way to properly handle IP addresses in a
database.  How else will you do range or subnet queries?

-brian




More information about the Snort-users mailing list