Snort mailing list archives
Re: Rule performance profiling question
From: Alex Kirk <akirk () sourcefire com>
Date: Wed, 15 Sep 2010 16:43:39 -0400
Definitely turn off SID 7019 - that's for a Japanese P2P service that's probably not on your network. SID 14643 is something you'll want to consider more closely based on the likelihood of being patched in your network. That said, your assessment of performance there is correct - it's expensive for not a great deal of return in your environment. On Wed, Sep 15, 2010 at 4:37 PM, Andy Berryman <aberryman () cymtec com> wrote:
Does this mean I should turn off this rule b/c of the amount of checks and zero alerts for it? Rule Profile Statistics (worst 100 rules) ========================================================== Num SID GID Rev Checks Matches Alerts Microsecs Avg/Check Avg/Match Avg/Nonmatch === === === === ====== ======= ====== ========= ========= ========= ============ 1 7019 3 5 234171143 0 0 80911378 0.3 0.0 0.3 What about this one? Not as many checks, but it takes a while to check it each time. Rule Profile Statistics (worst 100 rules) ========================================================== Num SID GID Rev Checks Matches Alerts Microsecs Avg/Check Avg/Match Avg/Nonmatch == === === === ====== ======= ====== ========= ========= ========= ============ 76 14643 3 3 82610 0 0 4949758 59.9 0.0 59.9 Thanks, Andy Berryman ------------------------------ This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) named above. If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this message in error and that any review, disclosure, copying, distribution or use of the contents of this message is strictly prohibited. If you have received this message in error, please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return e-mail. ------------------------------ ------------------------------------------------------------------------------ Start uncovering the many advantages of virtual appliances and start using them to simplify application deployment and accelerate your shift to cloud computing. http://p.sf.net/sfu/novell-sfdev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Alex Kirk AEGIS Program Lead Sourcefire Vulnerability Research Team +1-410-423-1937 alex.kirk () sourcefire com
------------------------------------------------------------------------------ Start uncovering the many advantages of virtual appliances and start using them to simplify application deployment and accelerate your shift to cloud computing. http://p.sf.net/sfu/novell-sfdev2dev
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Rule performance profiling question Andy Berryman (Sep 15)
- Re: Rule performance profiling question Alex Kirk (Sep 15)
- Re: Rule performance profiling question Andy Berryman (Sep 16)
- Re: Rule performance profiling question Joel Esler (Sep 16)
- Re: Rule performance profiling question waldo kitty (Sep 16)
- Re: Rule performance profiling question waldo kitty (Sep 16)
- Re: Rule performance profiling question Joel Esler (Sep 16)
- Re: Rule performance profiling question Andy Berryman (Sep 16)
- Re: Rule performance profiling question Alex Kirk (Sep 15)
- Re: Rule performance profiling question Joel Esler (Sep 15)
- Re: Rule performance profiling question waldo kitty (Sep 15)
- Re: Rule performance profiling question Joel Esler (Sep 15)
- Re: Rule performance profiling question waldo kitty (Sep 15)