Snort mailing list archives
Re: Pattern Matcher Performance (config detection)
From: Martin Holste <mcholste () gmail com>
Date: Thu, 24 Feb 2011 16:15:37 -0600
config detection: search-method ac-nq search-optimize max-pattern-len 20
Ok, looks like a pretty standard config, then. I'm going to try to see if I can replicate your results.
That said, I reproduced it several times and the difference was fairly striking. Again, perfprofiling reports that >80% of the CPU time for snort is spent in the MPSE due to my very large ruleset, so I may be a fairly extreme case.
I think this is the standard use case. My impression is that many (most?) users run at least a few thousand rules, and that means that the pattern matcher is doing almost all of the work. That's why I get concerned when people talk about pcap buffers, etc. because it implies that you can boost your sustained performance by boosting the buffers, when in fact an overloaded ruleset will not be saved by any amount of buffering, because the pattern matcher can't keep up. Multiple instances are your only hope for running the full ruleset against any kind of significant traffic. ------------------------------------------------------------------------------ Free Software Download: Index, Search & Analyze Logs and other IT data in Real-Time with Splunk. Collect, index and harness all the fast moving IT data generated by your applications, servers and devices whether physical, virtual or in the cloud. Deliver compliance at lower cost and gain new business insights. http://p.sf.net/sfu/splunk-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Pattern Matcher Performance (config detection) Mike Lococo (Feb 24)
- Re: Pattern Matcher Performance (config detection) Alan Ptak (Feb 24)
- Re: Pattern Matcher Performance (config detection) Martin Holste (Feb 24)
- Re: Pattern Matcher Performance (config detection) Mike Lococo (Feb 24)
- Re: Pattern Matcher Performance (config detection) Martin Holste (Feb 24)
- Re: Pattern Matcher Performance (config detection) Mike Lococo (Feb 24)
- Re: Pattern Matcher Performance (config detection) Martin Holste (Feb 24)
- Re: Pattern Matcher Performance (config detection) Mike Lococo (Feb 24)
- Re: Pattern Matcher Performance (config detection) Mike Lococo (Feb 24)