Frank Knobbe wrote:
On Tue, 2006-07-25 at 12:04 -0400, Joel Esler wrote:
Pass rules and Suppression are pretty much processed at the same time,
however, suppression does not require rule ordering, so it's preferred
your use Suppression.
Is that an accurate statement?
When a pass rule matches, the whole packet/stream is ignored, meaning
that any other rules are not matched (early out).
It is my understanding that suppression rules only become effective
after a signature match is successful, and if suppressed with that SID,
will not cause an alert *with that SID*. However, other SIDs may still
alert, so the packet/stream is getting evaluated by other rules.
So I can't see them being equal. In regards to performance it appears
that pass rules are faster (since no further matching occurs), which of
course means that one has to be careful using pass rules as they might
squelch other rules you might want an alert on.
Pass rules prevent any alerts from firing for the _packet(s)_ the pass
rule matches but they must be evaluated with all of the other rules. The
same performance considerations exist for pass rules as do alert rules
and the same impact is had as a result. A suppression on the other hand
does not add any rules and prevents the results of a rule from creating
an alert.
At least I recall that working like this at some point in time. Has that
changed?
Early exist logic went away with the addition of the fast pattern
matcher and multiple alerts per packet.
Regards,
Frank
------------------------------------------------------------------------
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
