Unfortunately results for Snort 1.8 are unreliable since post 2.0 versions are
MUCH faster (that's when the whole multi-pattern-matching algorithms thing came
in).
Results for Sourcefire IS3000 are not directly applicable to Snort because, as
you mention in your report, the Sourcefire sensor uses a custom packet capture
driver instead of pcap library. A custom driver gives MAJOR performance
increase, results for vanilla snort are not going to be anywhere near that good.
my 2 cents,
Paolo Milani
Subject: Re: [Snort-users] Snort performance
From: Bob Walder <bwalder@spamcop.net>
To: Ramkumar Chinchani <rc27@cse.Buffalo.EDU>,
Snort-Users Mailing List <snort-users@lists.sourceforge.net>
We looked at open source Snort some time ago (back in the V1.8 days) and
that appears in one of our earlier reports.
However, our latest Gigabit IDS report includes detailed performance tests
of the Sourcefire IS3000 which is, of course, based on Snort
(www.nss.co.uk/gigabitids).
Bob Walder
The NSS Group
On 25/3/05 11:33 pm, "Ramkumar Chinchani" <rc27@cse.Buffalo.EDU> wrote:
Hi all,
I am looking for references/pointers to any documented measurements on
Snort's performance overheads, latency and such.
Thanks,
_R
Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.
====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
MailAdmin@tilab.com. Thank you
====================================================================
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&opÌk
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
