Re: regarding Snort design.

[Erek Adams <erek () theadamsfamily net>]

On Tue, 23 Apr 2002, Ashley Thomas wrote:

> Will it be correct to tell that most of the work is being done at the
> snort pre processors ? If anyone can make a **crude** assumtion on the
> percentage of work (in terms of processing time) done at preprocessor
> level....
> (Assuming we load all the preprocessors: frag2,stream4,stream4_reassembly,
> portscan,http_decode etc)

Ashley, I'm not a coder--I've just futzed with this for quite a bit.  :)  So
please take my words with a grain of salt.

The main work is done in the pattern matching of the rulesets.  If your
$HOME_NET is set to a 'large' number of 'nets you are by far better off
running multi snort instances than a combined $HOME_NET.

I'm adding the developers list to the CC: so that someone more clueful than
myself can speak up, if I'm completely crackheaded.

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users