Snort mailing list archives
Multi-Pattern Matching Engine in Snort
From: Siti Farhana Binti Lokman <sitifarhana.lokman () postgrad manchester ac uk>
Date: Fri, 3 Jul 2015 13:12:52 +0000
Hi, Currently I'm doing a comparative study on analysing performance of multi-pattern matching engine in Snort. Based on my findings of inner working in Snort so far, it has included more pattern matching algorithms as configuration options of the signature matching engine like AC-FULL, MWM, LOW_MEM, etc. But, if I want to do some modifications or additions (compare other pattern matching algorithms with existing unmodified algorithms in Snort), so how can I compile the source code and test the performance? I'm planning to measure the performance of memory usage vs. speed of a new search method using the latest ruleset in Snort "snortrules-snapshot-2962.tar.gz<https://snort.org/downloads/registered/snortrules-snapshot-2962.tar.gz>" with some precaptured PCAP files. Right now I'm having difficulties finding resources in technical part especially on how to compile and run the code. I read some papers the source code files involve is: fpcreate.c, mpse.c, mpse.h and new C files of a new algorithms. But can you suggest me if there's any technical documentations or step by step on how to accomplish this? I'm really sorry as I'm really new in this area and still learning. Any suggestions and advice is much appreciated. Thank you in advance. Best regards, Farhana
------------------------------------------------------------------------------ Don't Limit Your Business. Reach for the Cloud. GigeNET's Cloud Solutions provide you with the tools and support that you need to offload your IT needs and focus on growing your business. Configured For All Businesses. Start Your Cloud Today. https://www.gigenetcloud.com/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Multi-Pattern Matching Engine in Snort Siti Farhana Binti Lokman (Jul 03)
- Re: Multi-Pattern Matching Engine in Snort Al Lewis (allewi) (Jul 03)