Re: perf_test.sh

Hi

> But from the measured data below, we can see “Detect-Min < Inspect” for all three PCAPS. I guess my assumption must be wrong. Any comments?

The detect-min.lua overrides http_inspect.request_depth and http_inspect.response_depth. Thus, HTTP inspector processes less in detect-min case.

Regards,
Alexey

On 16 Feb 2024, at 17:59, Li, Charlie via Snort-users <[email protected]> wrote:


[AMD Official Use Only - General]

Thanks Vitalii,

It really helps!

Based on the definitions, I would assume that (time in ns):

Detect-Max >= Detect-Min >= Inspect >= Stream >= Decode
Network-Awareness >= Stream >= Decode

But from the measured data below, we can see “Detect-Min < Inspect” for all three PCAPS. I guess my assumption must be wrong. Any comments?

~/snort/snort3_demo/perf/3.0$ ./perf_test.sh hyperscan 3 8

conf
mpse
n
pcap
8T
decode
hyperscan
3
defcon
2.25
stream
hyperscan
3
defcon
3.574
inspect
hyperscan
3
defcon
6.483
detect-min
hyperscan
3
defcon
6.264
detect-max
hyperscan
3
defcon
6.685
network-awareness
hyperscan
3
defcon
3.669
decode
hyperscan
3
get250
1.441
stream
hyperscan
3
get250
2.501
inspect
hyperscan
3
get250
3.585
detect-min
hyperscan
3
get250
3.013
detect-max
hyperscan
3
get250
3.534
network-awareness
hyperscan
3
get250
2.382
decode
hyperscan
3
maccdc
9.214
stream
hyperscan
3
maccdc
24.21
inspect
hyperscan
3
maccdc
45.232
detect-min
hyperscan
3
maccdc
44.548
detect-max
hyperscan
3
maccdc
44.604
network-awareness
hyperscan
3
maccdc
47.652



Regards,
Charlie Li

From: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]<mailto:[email protected]>>
Sent: Friday, February 16, 2024 3:36 AM
To: Li, Charlie <[email protected]<mailto:[email protected]>>; [email protected]<mailto:[email protected]>
Subject: Re: [Snort-users] perf_test.sh


[AMD Official Use Only - General]


Caution: This message originated from an External Source. Use proper caution when opening attachments, clicking links, or responding.

Hi Charlie!

Thanks for pointing this out.
Network-Awareness is a minimal config for RNA inspector. Real-time Network Awareness (RNA) inspector provides visibility into a network using Passive Network Discovery (PND).
RNA analyzes traffic to discover hosts on the network and to detect operating system running on a host. It uses fingerprints for OS detection.
It logs ip/mac addresses, ports, protocols, OS, and other information about traffic running on these hosts. It does not generate or alter traffic on its own.
If you’re interested, you can read more on that here: snort3/src/network_inspectors/rna/dev_notes.txt at master · snort3/snort3 (github.com)<https://github.com/snort3/snort3/blob/master/src/network_inspectors/rna/dev_notes.txt>

Regarding the “full configuration” statement, it means a configuration that covers the main part of commonly used protocols with the corresponding inspectors. It also includes basic file policy configurations, things needed to identify protocols and profile Snort 3. However, it does not include RNA, rules and some other things. I would say that this is a basic configuration that covers most of the traffic processing.

Hope this will help you.

Thanks,
Vitalii!

From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Li, Charlie via Snort-users <[email protected]<mailto:[email protected]>>
Date: Friday, 16 February 2024 at 01:19
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] perf_test.sh

[AMD Official Use Only - General]


Hi All,

I am running perf_test.sh to measure Snort3 performance against the community rules.

It runs the following configs:

  *   Decode
  *   Stream
  *   Inspect
  *   Detect-Min
  *   Detect-Max
  *   Network-Awareness


The README doc gives the following definitions of the above configs.


  1.  decode.{conf,lua} - just decode packets.  No inspectors or rules.
  2.  stream.{conf,lua} - adds stream only to decode conf.  No non-stream inspectors. No rules.
  3.  inspect.{conf,lua} - full configuration w/o rules.
  4.  detect-min.{conf,lua} - adds rules to snort.conf.
  5.  detect-max.{conf,lua} - same as min except with unlimited http flow depths.


It does not define “Network-Awareness” – what does it mean?

For “inspect”, what does “full configuration” mean?

Regards,
Charlie Li
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette