[Snort-users] Suppress versus #Rule for performance.

Joel Esler jesler at ...1935...
Thu May 20 17:04:04 EDT 2010

On May 20, 2010, at 4:55 PM, Bill Pickens wrote:

> Hello Everyone,
> After Snort has loaded....
> Is there a difference in Snort performance between suppressing a rule or "#" commenting the rule out?

Commenting out a rule turns the rule off, which means that content does not need to be memorized, therefore -- faster.

Suppressing a rule just turns off the alert, the rule is still being ran.

Joel Esler

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100520/386c25dd/attachment.html>

More information about the Snort-users mailing list