Re: Packet Performance Monitor

Thanks Russ, much appreciated.   This kind of begs the question, when PPM
suspends a rule, does the single rule get suspended or the entire tree
(which could be multiple rules)?

Thanks.

-Mike Cox

On Mon, Sep 26, 2016 at 8:57 AM, Russ <[email protected]> wrote:

> Hey Mike,
>
> This has been a "feature" of Snort for quite a while and likely will only
> be fixed in Snort++, which inherited the issue.  It arose when we added a
> performance feature to compile all the rules that share a fast pattern
> match end state into a single tree that can be evaluated more quickly than
> iterating over the individual rules.  Such rules tend to have a lot in
> common and the common part is evaluated just once.  Consequently, when the
> tree triggers a latency event, it could be one or more rules that are at
> fault.  I'm thinking we will add a mapping and report the index that can be
> used to find the rules.  This is in our backlog.
>
> Thanks
> Russ
>
>
> On 9/26/16 8:27 AM, Mike Cox wrote:
>
> Perhaps snort-sigs was the wrong place to post this.  Removing them and
> adding snort-devel.
>
> Thanks.
>
> Mike Cox
>
> On Thu, Sep 22, 2016 at 10:59 AM, Mike Cox <[email protected]> wrote:
>
>> I've been messing around with the Packet Performance Monitor (PPM)
>> preprocessor and it seem like a nice capability of Snort.
>>
>> However, when I configure it to suspend/disable expensive rules once the
>> thresholds are reached, how do I know which rule was suspended?  I see it
>> generates the GID 134 alert along with the packet it was considering at the
>> time but I need to be able to know what rule was suspended so I can:
>>
>> 1) account for and correlate the coverage gap (if necessary)
>> 2) tune the rule
>>
>> Thanks!
>>
>> Mike Cox
>>
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Snort-devel mailing [email protected]://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
>
>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!