Snort mailing list archives
RE: snort 2.0 performance evaluation
From: "James R. Hendrick" <hendrick () keane-nne com>
Date: Tue, 3 Jun 2003 15:10:46 -0400
How does this compare to pre 2.0 snort on the same testbed? -----Original Message----- From: Terence R.T. Liu [mailto:tie19858 () ms45 hinet net] Sent: Tuesday, June 03, 2003 12:23 PM To: snort-users () lists sourceforge net Subject: [Snort-users] snort 2.0 performance evaluation We downloaded the latest snort 2.0 and put it into a P4 IPC w/ PCI-X bus and 2 broadcom gigabit NICs. Then we tested it w/ IXIA http generator to evaluate the performance and throughput. However, the average throughput is pretty lower from 18Mbps (packet size is 128 bytes) to 80 Mbps (packet size is 1460 bytes). The number of enabled rule is about 1,300. Since the current version has employ the Wu's algorithm to handle the multiple-pattern matching, we assumed the performance should be boosted. Does anyone figure this out? Does the testing result sound reasonable? Thanks, Terry.
Current thread:
- snort 2.0 performance evaluation Terence R.T. Liu (Jun 03)
- Re: snort 2.0 performance evaluation Jeff Nathan (Jun 03)
- <Possible follow-ups>
- RE: snort 2.0 performance evaluation James R. Hendrick (Jun 03)