2.8.4 performance improvements

["Jefferson, Shawn" <Shawn.Jefferson () bcferries com>]

Hi,

One of things that was talked about in the webcast on 2.8.4 was a performance improvement, but the trade-off is that 
rules with Any -> Any won't be processed by some of the pre-processor's (like Stream5).  I was curious about how many 
rules are Any -> Any, and in my configuration (files with none are removed):

attack-responses.rules:1
bad-traffic.rules:4
deleted.rules:5
dns.rules:2
emerging-attack_response.rules:2
emerging-malware.rules:1
emerging-p2p.rules:6
emerging-policy.rules:31
emerging-scan.rules:7
emerging-virus.rules:34
exploit.rules:4
icmp.rules:3
policy.rules:2
tftp.rules:8

So, my question is, is it worth turning this new feature on?  Is anyone else using it yet?  Better performance sounds 
good...

Thanks,
Shawn




------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing 
server and web deployment.
http://p.sf.net/sfu/businessobjects

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users