[Snort-users] Snort 2.8.3 Performance Metrics (Avg/Match)

Geoff Whittington geoff.whittington at ...11827...
Thu Oct 16 09:57:08 EDT 2008


Hello,

We've been giving 2.8.3 a whirl specifically to use snort's metrics. The
following is a sample output of a single run of snort against one pcap and
one snort signature.

   Num      SID GID     Checks     Matches     Alerts          Microsecs
Avg/Check     Avg/Match    Avg/Nonmatch
   ===      === ===     ======   =======    ======       =====
=========  ========= ============
     1        151   1         36           36              36
20254         562.6            0.2               0.0


Since Checks=Matches=36 I would have expected Avg/Match to be 562.2, not
0.2. Is the documentation correct?


Thanks,
 - Geoff

According to the URL:
http://www.snort.org/docs/snort_htmanuals/htmanual_283/node150.html

The columns represent:

   - Number (rank)
   - Sig ID
   - Generator ID
   - Checks (number of times rule was evaluated after fast pattern match
   within portgroup or any-rules)
   - Matches (number of times ALL rule options matched, will be high for
   rules that have no options)
   - Alerts (number of alerts generated from this rule)
   - CPU Ticks
   - Avg Ticks per Check
   - Avg Ticks per Match
   - Avg Ticks per Nonmatch
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20081016/e23957e6/attachment.html>


More information about the Snort-users mailing list