RE: Snort performance

[Milani Paolo <Paolo.Milani () TILAB COM>]

Unfortunately results for Snort 1.8 are unreliable since post 2.0 versions are MUCH faster (that's when the whole 
multi-pattern-matching algorithms thing came in).

Results for Sourcefire IS3000 are not directly applicable to Snort because, as you mention in your report, the 
Sourcefire sensor uses a custom packet capture driver instead of pcap library. A custom driver gives MAJOR performance 
increase, results for vanilla snort are not going to be anywhere near that good.

my 2 cents,
Paolo Milani

> Subject: Re: [Snort-users] Snort performance
> From: Bob Walder <bwalder () spamcop net>
> To: Ramkumar Chinchani <rc27 () cse Buffalo EDU>,
>       Snort-Users Mailing List <snort-users () lists sourceforge net>
>
> We looked at open source Snort some time ago (back in the V1.8 days) and
> that appears in one of our earlier reports.
>
> However, our latest Gigabit IDS report includes detailed performance tests
> of the Sourcefire IS3000 which is, of course, based on Snort
> (www.nss.co.uk/gigabitids).
>
> Bob Walder
> The NSS Group
>
>
>
> On 25/3/05 11:33 pm, "Ramkumar Chinchani" <rc27 () cse Buffalo EDU> wrote:
>
> > Hi all,
> >
> > I am looking for references/pointers to any documented measurements on
> > Snort's performance overheads, latency and such.
> >
> > Thanks,
> >
> > _R


Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
MailAdmin () tilab com. Thank you
====================================================================


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users