Re: [Snort-sigs] Snort ClamAV for 2.3.3

[Jason Haar <Jason.Haar () trimble co nz>]

Will Metcalf wrote:

> To be honest I'm not really sure about the amount of overhead added by
> enabling this preproc.  Victor and I both just use our home PCs to
> development on and don't have the facilities available for load
> testing or anything of that nature.  I'm sure there is additional
> overhead especially when using the file-descriptor scanning.
> Regards,
>  
What about this simple test.

a. Use tcpdump to capture a bunch of data - including NetBIOS traffic.
b. run "pure" snort over it via "time snort -v -r tcpdump.log"
c. run snort-clamav over it "time snort -v -r tcpdump.log"

At least that would give some indication of extra CPU time and execution 
time...?

--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1



-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.
Get your fingers limbered up and give it your best shot. 4 great events, 4
opportunities to win big! Highest score wins.NEC IT Guy Games. Play to
win an NEC 61 plasma display. Visit http://www.necitguy.com/?r=20
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users