FAQ submission: optimizing performance of rules with PCRE

[James Affeld <jamesaffeld () yahoo com>]

"How can I get the best performance with rules that
include PCRE content checks?"

I understand from Nigel on the VRT and Matt Jonkman
that putting in a content: check ahead of the PCRE:
helps performance even if the content check doesn't
otherwise do anything the pcre doesn't handle. 
Something about the content check forcing the program
exectution to the optimal pattern patch code, which
won't happen without "bare" pcre.  

In other words, a rule like 

alert tcp $EXTERNAL_NET any -> any any (msg:"Faster
PCRE rule"; content: "content checked"; nocase; pcre:
"/content checked/i";)

will perform better than

alert tcp $EXTERNAL_NET any -> any any (msg:"Slower
PCRE rule"; pcre: "/content NOT checked/i";)

because the redundant content: check causes the more
efficient pattern matching code to be invoked.  

Disclaimer: I'm pretty confident I understand what to
do, but the explanation for why it works this way is
all 2nd hand and filtered through my imperfect brain. 


Disclaimer 2: I should not be credited - merely
echoing the lore of others.

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users