Re: Updated IP Blacklisting patch (version 2)

[Eoin Miller <eoin.miller () trojanedbinaries com>]

Martin Roesch wrote:
> On Thu, Jul 9, 2009 at 9:34 AM, Eoin
> Miller<eoin.miller () trojanedbinaries com> wrote:
>
> Good point, I'll make the change.
>
> Any stats on CPU usage?  Did the gotos or different arrangement result
> in any savings?
>
>
> Marty
>
>
>   
Looks like the gotos actually end up using slightly more processing time
for some reason? These two processes were started within a second of
each other. The iplist with goto's ends up using slightly more time
after running for a few hours:


%CPU %MEM    TIME+ 
COMMAND                                                                                        

  54  3.6  58:09.50 snort -c /etc/snort/snort-goto-yes.conf -l
/root/goto-yes/log/ -A fast                         
  26  3.6  54:21.04 snort -c /etc/snort/snort-goto-no.conf -l
/root/goto-no/log/ -A fast                           
                  
Performance graphs are pretty similiar, there was a bit of a spike in
the version that is NOT using the goto's at one point. But overall the
non-goto version appears to be more streamlined ever so slightly:

http://trojanedbinaries.com/security/snort/cpu-goto-vs-original.png

Color Lines = goto version
Black Lines = without goto's

Not exactly what I was expecting. Also, since we are not using the
whitelisting functionality I can't say that there isn't an increase in
performance in that aspect, I would expect there to be one.

--
Eoin Miller


------------------------------------------------------------------------------
Enter the BlackBerry Developer Challenge  
This is your chance to win up to $100,000 in prizes! For a limited time, 
vendors submitting new applications to BlackBerry App World(TM) will have
the opportunity to enter the BlackBerry Developer Challenge. See full prize  
details at: http://p.sf.net/sfu/Challenge
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users