RE: Why is snort "lightweight"?

["Scott, Joshua" <Joshua.Scott () Jacobs com>]

Snort by itself is lightweight.  Snort is modular in design so it gets
larger when you start adding in preprocessors and rules.  I believe that
Snort complies the preprocessors and rules at runtime.  If you configured it
with only a few rules and no preprocessors, then it would be extremely
lightweight.  


Joshua Scott
Security Systems Analyst, CISSP
626-568-7024


-----Original Message-----
From: Bennett Todd [mailto:bet () rahul net] 
Sent: Wednesday, November 13, 2002 8:55 AM
To: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Why is snort "lightweight"?


2002-11-12-13:54:39 twig les:
> http://www.snort.org/docs/lisapaper.txt

Nice ptr. Clearly shows what was meant by lightweight, sufficiently
objectively that we can say, snort is no longer lightweight:-).

The paper says "Snort is well suited to fill these roles, weighing in at
roughly 100 kilobytes in its compressed source distribution."

snort-1.9.0.tar.gz is 1.8MB; snortrules-current.tar.gz is about 100KB these
days.

-Bennett

======================================================================================
NOTICE - This communication may contain confidential and privileged information that is for the sole use of the 
intended recipient. Any viewing, copying or distribution of, or reliance on this message by unintended recipients is 
strictly prohibited. If you have received this message in error, please notify us immediately by replying to the 
message and deleting it from your computer.

==============================================================================



-------------------------------------------------------
This sf.net email is sponsored by: To learn the basics of securing 
your web site with SSL, click here to get a FREE TRIAL of a Thawte 
Server Certificate: http://www.gothawte.com/rd524.html
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users