[Snort-users] 2.8.4 performance improvements

Jefferson, Shawn Shawn.Jefferson at ...14448...
Mon Apr 27 12:53:09 EDT 2009


Hi,

One of things that was talked about in the webcast on 2.8.4 was a performance improvement, but the trade-off is that rules with Any -> Any won't be processed by some of the pre-processor's (like Stream5).  I was curious about how many rules are Any -> Any, and in my configuration (files with none are removed):

attack-responses.rules:1
bad-traffic.rules:4
deleted.rules:5
dns.rules:2
emerging-attack_response.rules:2
emerging-malware.rules:1
emerging-p2p.rules:6
emerging-policy.rules:31
emerging-scan.rules:7
emerging-virus.rules:34
exploit.rules:4
icmp.rules:3
policy.rules:2
tftp.rules:8

So, my question is, is it worth turning this new feature on?  Is anyone else using it yet?  Better performance sounds good...

Thanks,
Shawn




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090427/48411beb/attachment.html>


More information about the Snort-users mailing list