Re: perf_test.sh

Charlie,

snort3_demo/perf/lightspd/3.0/ is a better way to test Snort 3 performance. It is similar to what you are doing with snort3_demo/perf/3.0/, but it takes advantage of the Talos lightSPD package which bundles config and rules into several policies. It also has more than 10X the number of rules in the community set. And using a standard lightSPD policy will make it easier for others to help and to reproduce your results.

https://snort.org/downloads/registered/Talos_LightSPD.tar.gz

Russ

________________________________
From: Snort-users <[email protected]> on behalf of Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) via Snort-users <[email protected]>
Sent: Friday, February 16, 2024 4:36 AM
To: Li, Charlie <[email protected]>; [email protected] <[email protected]>
Subject: Re: [Snort-users] perf_test.sh


Hi Charlie!

Thanks for pointing this out.
Network-Awareness is a minimal config for RNA inspector. Real-time Network Awareness (RNA) inspector provides visibility into a network using Passive Network Discovery (PND).
RNA analyzes traffic to discover hosts on the network and to detect operating system running on a host. It uses fingerprints for OS detection.
It logs ip/mac addresses, ports, protocols, OS, and other information about traffic running on these hosts. It does not generate or alter traffic on its own.
If you’re interested, you can read more on that here: snort3/src/network_inspectors/rna/dev_notes.txt at master · snort3/snort3 (github.com)<https://github.com/snort3/snort3/blob/master/src/network_inspectors/rna/dev_notes.txt>

Regarding the “full configuration” statement, it means a configuration that covers the main part of commonly used protocols with the corresponding inspectors. It also includes basic file policy configurations, things needed to identify protocols and profile Snort 3. However, it does not include RNA, rules and some other things. I would say that this is a basic configuration that covers most of the traffic processing.

Hope this will help you.

Thanks,
Vitalii!



From: Snort-users <[email protected]> on behalf of Li, Charlie via Snort-users <[email protected]>
Date: Friday, 16 February 2024 at 01:19
To: [email protected] <[email protected]>
Subject: [Snort-users] perf_test.sh

[AMD Official Use Only - General]



Hi All,



I am running perf_test.sh to measure Snort3 performance against the community rules.



It runs the following configs:

  *   Decode
  *   Stream
  *   Inspect
  *   Detect-Min
  *   Detect-Max
  *   Network-Awareness



The README doc gives the following definitions of the above configs.



  1.  decode.{conf,lua} - just decode packets.  No inspectors or rules.
  2.  stream.{conf,lua} - adds stream only to decode conf.  No non-stream inspectors. No rules.
  3.  inspect.{conf,lua} - full configuration w/o rules.
  4.  detect-min.{conf,lua} - adds rules to snort.conf.
  5.  detect-max.{conf,lua} - same as min except with unlimited http flow depths.



It does not define “Network-Awareness” – what does it mean?



For “inspect”, what does “full configuration” mean?



Regards,

Charlie Li

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette