[Snort-users] Pattern Matcher Performance (config detection)

Martin Holste mcholste at ...11827...
Thu Feb 24 17:15:37 EST 2011

> config detection: search-method ac-nq search-optimize max-pattern-len 20

Ok, looks like a pretty standard config, then.  I'm going to try to
see if I can replicate your results.

> That said, I reproduced it several times and the difference was fairly
> striking.  Again, perfprofiling reports that >80% of the CPU time for
> snort is spent in the MPSE due to my very large ruleset, so I may be a
> fairly extreme case.

I think this is the standard use case.  My impression is that many
(most?) users run at least a few thousand rules, and that means that
the pattern matcher is doing almost all of the work.  That's why I get
concerned when people talk about pcap buffers, etc. because it implies
that you can boost your sustained performance by boosting the buffers,
when in fact an overloaded ruleset will not be saved by any amount of
buffering, because the pattern matcher can't keep up.  Multiple
instances are your only hope for running the full ruleset against any
kind of significant traffic.

More information about the Snort-users mailing list