[Snort-users] Improving performance by timing each rule?

OlRoy OlRoy olroy1212 at ...131...
Fri Apr 13 10:50:15 EDT 2007

I'm reading Snort IDS and IPS Toolkit and in it they said that even the fastest computer could be incapable of monitoring a 56k link if you're using rules that were poorly written.  Given that performance is important with Snort, and that rules affect performance, would it be helpful if Snort had a way of printing rules that are taking the longest time to process?  A top 10 list would enable people to see rules might need to be modified or removed.

Ahhh...imagining that irresistible "new car" smell?
 Check outnew cars at Yahoo! Autos.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070413/0c5fdddc/attachment.html>

More information about the Snort-users mailing list