OK thank you very much..<br><br><div class="gmail_quote">2010/11/5 Rodrigo Montoro(Sp0oKeR) <span dir="ltr"><<a href="mailto:spooker@...13704......" target="_blank">spooker@...11827...</a>></span><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">

I'd suggest you to read those urls bellow:<br>
<br>
<a href="http://www.snort.org/assets/126/WhitePaper_Snort_PerformanceTuning_2009.pdf" target="_blank">http://www.snort.org/assets/126/WhitePaper_Snort_PerformanceTuning_2009.pdf</a><br>
<br>
<a href="http://blog.joelesler.net/2010/04/fun-with-profile_rules.html" target="_blank">http://blog.joelesler.net/2010/04/fun-with-profile_rules.html</a><br>
<br>
About Host Attribute Table is a good read/understand to specially if<br>
you are using rules that uses metadata field.<br>
<br>
<a href="http://global-security.blogspot.com/2010/09/pig-doktah-is-born.html" target="_blank">http://global-security.blogspot.com/2010/09/pig-doktah-is-born.html</a><br>
<br>
<a href="http://global-security.blogspot.com/2010/10/haz-drowning-rat-pulledpork-050-is-now.html" target="_blank">http://global-security.blogspot.com/2010/10/haz-drowning-rat-pulledpork-050-is-now.html</a><br>
<br>
Hope it helps!<br>
<br>
Regards,<br>
<div><div></div><div><br></div></div><font color="#888888">
<a href="http://www.linkedin.com/in/spooker" target="_blank"></a><br>
</font></blockquote></div><br>