Re: Help tuning snort for performance.

["Andy Berryman" <aberryman () Cymtec com>]

Well, the issue with that is, the end user is the one responsible for
turning on/off rules. We leave it to them to turn them on or off b/c if
I turn one off and they get attacked and there was no event recorded,
I'm the one on the hook. So, we place the responsibility on them to turn
on or off the rules. We will go through and turn off major false
positives that we see, like the bare-byte unicode alerts.  So, with that
being said, it's probably a poorly tuned rule set. 

 

Does that make any sense? I know to me, it's a catch-22. 

 

Thanks,

Andy 

 

From: Alex Kirk [mailto:akirk () sourcefire com] 
Sent: Thursday, February 11, 2010 11:05 AM
To: Andy Berryman
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Help tuning snort for performance.

 

I'm not the best-qualified to speak to the issue of frag tuning, but
given such a high dropped-packet rate, I figured I would raise another
possibility that I can discuss intelligently: how well-tuned is your
rule set? If you've got a whole bunch of unnecessary rules, turning them
off could make the rest of your tuning needs basically moot.

 

 


------------------------------------------------------------------------
------
SOLARIS 10 is the OS for Data Centers - provides features such as
DTrace,
Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW
http://p.sf.net/sfu/solaris-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users
<https://lists.sourceforge.net/lists/listinfo/snort-users%0d%0aSnort-use
rs>  list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




-- 
Alex Kirk
AEGIS Program Lead
Sourcefire Vulnerability Research Team
+1-410-423-1937
alex.kirk () sourcefire com


###############################################################################
This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) 
named above.  If you are not the intended recipient or an agent responsible for delivering it to the intended 
recipient, you are hereby notified that you have received this message in error and that any review, disclosure, 
copying, distribution or use of the contents of this message is strictly prohibited.  If you have received this message 
in error, please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return 
e-mail.                    
###############################################################################

------------------------------------------------------------------------------
SOLARIS 10 is the OS for Data Centers - provides features such as DTrace,
Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW
http://p.sf.net/sfu/solaris-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users