Taking out the traffic on ports 22 and 443 suggestive?

[Edin Dizdarevic <edin.dizdarevic () interActive-Systems de>]

Hi everybody,

I was wondering if it would make sense to relief Snort by taking
out the ports 22 and 443 using the BPF filters. HTTP(S) packets are
usually quite big and looking inside of them is quite senseless for
obvious reasons. With SSH stream4 is additionally burdened since those
packets are usually quite small and are filling up it's memory waiting
to be reassembled. Senseless too, IMHO...

Of course scans won't be seen, but is that really important since
a simple connect scan will find those ports open?

Any comments on that?

Regards,

Edin

-- 
Edin Dizdarevic



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users