Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort
Snort News Downloads Snort Docs Rules Snort Community Snort Forums Snort Training
Search Site
Search Rules
Account
email
password
not registered?
user preferences

Snort Forums Archive

Archive Home » Snort Development » Detection Engine Architecture

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Detection Engine Architecture


Posted by TheMadHatter on March 04, 2006 15:14:40

Hello everyone,

I am currently at university and am writing my final year dissertation, part of which involves analyzing Snort. I have read Martin Roesch's paper from LISA '99 and am using that as a basis for much of my analysis.

My question to the experts is: Does anyone know if Snort's Detection Engine still uses the linked list structure detailed in Roesch's paper (Figure 3, pp231) to store the rule chain? If so, is it a basic linked list, i.e. can only be traversed one-way?

Thanks to anyone who can help on this matter!

Scott.

Posted by Salehi on May 31, 2008 03:17:16

Hi
I think snort still uses a basic one-way link list to trace the rule chain....
If so there are many optimiza techniques which coul be implemented leading to more speed and flexibility ..
One of them is a techniques which i know myself as "Partition Link List",as you may know in modern databases, indexes on tables with huge amount of data is partitioned leading to more speed and less exclusive access limitation by creating seprated files for each partition...
we can use some thing aroud this in our programs .. i mean Snort can partition his long chained rule list to many small chaind rule list which are seprated accordint to some criteria like protocol in packets, or even IP addr depending on network situation. I think protocol Partitioning is mor efficient...
Using this each time just the appropriate list in traversed leading to less time and conjunction.
This enpower Snort so that it can work on higher speed networks ..
I am going to implement this in the Source.
please let me know if any one has suggestion ..
Regards
Hamed ;)

site feedback | Terms of Use | Privacy Policy | forum archives ©2007 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.