Re: FAQ submission: optimizing performance of rules with PCRE

["David J. Bianco" <david () vorant com>]

The easiest way to understand this is to know that snort processes
the rule keywords in the order they are given and stops processing
as soon as one of the matches fails.  Also know that the PCRE engine
is usually slower than the "content" match engine.

By putting a simple "content" match before the PCRE, you save CPU
cycles.  Without it, you'd be using the slower engine on every
packet the rule processes.  With "content", you use the fast engine
and can throw away packets that don't have a hope of matching the
regular expression anyway.  Then you only pay the big performance
penalty on (hopefully) a small percentage of the total traffic.

You can see an example of this in my "EZ Snort Rules" presentation
(http://www.vorant.com/files/EZ_Snort_Rules.pdf) if it helps
make things more clear.

        David

James Affeld wrote:
> "How can I get the best performance with rules that
> include PCRE content checks?"
>
> I understand from Nigel on the VRT and Matt Jonkman
> that putting in a content: check ahead of the PCRE:
> helps performance even if the content check doesn't
> otherwise do anything the pcre doesn't handle. 
> Something about the content check forcing the program
> exectution to the optimal pattern patch code, which
> won't happen without "bare" pcre.  
>
> In other words, a rule like 
>
> alert tcp $EXTERNAL_NET any -> any any (msg:"Faster
> PCRE rule"; content: "content checked"; nocase; pcre:
> "/content checked/i";)
>
> will perform better than
>
> alert tcp $EXTERNAL_NET any -> any any (msg:"Slower
> PCRE rule"; pcre: "/content NOT checked/i";)
>
> because the redundant content: check causes the more
> efficient pattern matching code to be invoked.  
>
> Disclaimer: I'm pretty confident I understand what to
> do, but the explanation for why it works this way is
> all 2nd hand and filtered through my imperfect brain. 
>
>
> Disclaimer 2: I should not be credited - merely
> echoing the lore of others.
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users