Snort Forums Archive

Archive Home » Rules » www.turbosnortrules.org

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

www.turbosnortrules.org

Posted by maverick on May 05, 2005 06:30:24

Me and the guys at VigilantMinds (www.vigilantminds.com) have come up with a new rules performance testing website, http://www.turbosnortrules.org. Basically, the idea is that you submit your rule to the website, it finds the relative performance on our test servers, and shows you how it stacks up compared to the current snort rulesets. This is important when Snort's efficiency is crucial, such as in gigabit networks.

The site also has a handful of other useful tools like a wiki for listing ways to make snort faster and a searchable/sortable archive of all tested rules (snort default and user submitted) to easily identify inefficient rules. Take a look and tell us what you think. Hope its as useful to you as it has been for us.

Posted by bdinello on May 23, 2005 12:33:26

Just as an FYI, we've finished testing the ruleset against snort 2.3.3. The 2.3.3 engine is also now available to test your rules.

Check it out at www.turbosnortrules.org.

Regards,

Brian

Posted by bdinello on June 17, 2005 05:54:01

Update: The bleeding snort ruleset has been tested against Snort v2.3.3 at http://www.TurboSnortRules.org. All of these rules are viewable/sortable in the test archive. Most notably, you can sort by RME to see which bleeding snort submissions perform the best or worst.

As new bleeding snort rules are released, TurboSnortRules will dynamically retrieve and test them. If you have any feedback or ideas, be sure to shoot us an email.