[Snort-users] Preproc tuning

Joel Esler eslerj at ...11827...
Fri Jun 17 11:22:25 EDT 2005


I know what it does.  What I am saying is, if you specify them in the
.conf file, as opposed to letting the compiled code do it, is it
faster?  In my tests it's showing significant CPU performance
increase..

J

On 6/17/05, snort user <snort.user at ...11827...> wrote:
> Those are the default ports for which state tracking/reassembly is done
> if you dont specify anything in the snort.conf
> 
> #   ports [list] - use the space separated list of ports in [list], "all"
> #                  will turn on reassembly for all ports, "default" will turn
> #                  on reassembly for ports 21, 23, 25, 53, 80, 143, 110, 111
> #                  and 513
> 
> 
> On 6/17/05, Joel Esler <eslerj at ...11827...> wrote:
> > Has anyone else noticed a significant performance increase by
> > specifying the ports for stream4?
> >
> > If I look at the code for stream 4, take the ports that are in there.
> > and specify them via the snort.conf
> >
> > ports: < 21 23 25 53 42 80 110 111 143 513 >....etc..
> >
> > It is SO much faster and doesn't consume as much CPU resources...
> >
> > anyone?
> >
> >
> > -------------------------------------------------------
> > SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> > from IBM. Find simple to follow Roadmaps, straightforward articles,
> > informative Webcasts and more! Get everything you need to get up to
> > speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&opclick
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?listsnort-users
> >
>




More information about the Snort-users mailing list