[Snort-users] FAQ submission: optimizing performance of rules with PCRE

James Affeld jamesaffeld at ...131...
Tue May 2 12:05:02 EDT 2006

"How can I get the best performance with rules that
include PCRE content checks?"

I understand from Nigel on the VRT and Matt Jonkman
that putting in a content: check ahead of the PCRE:
helps performance even if the content check doesn't
otherwise do anything the pcre doesn't handle. 
Something about the content check forcing the program
exectution to the optimal pattern patch code, which
won't happen without "bare" pcre.  

In other words, a rule like 

alert tcp $EXTERNAL_NET any -> any any (msg:"Faster
PCRE rule"; content: "content checked"; nocase; pcre:
"/content checked/i";)

will perform better than

alert tcp $EXTERNAL_NET any -> any any (msg:"Slower
PCRE rule"; pcre: "/content NOT checked/i";)

because the redundant content: check causes the more
efficient pattern matching code to be invoked.  

Disclaimer: I'm pretty confident I understand what to
do, but the explanation for why it works this way is
all 2nd hand and filtered through my imperfect brain. 

Disclaimer 2: I should not be credited - merely
echoing the lore of others.

Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 

More information about the Snort-users mailing list