Output

Snort - the de facto standard for intrusion detection/prevention

the de facto standard in IPS

Search Site

Search Rules

Account

email
password

not registered?

user preferences

Next: Preprocessor Profiling Up: Rule Profiling Previous: Examples Contents

Output

Snort will print a table much like the following at exit.

**Figure 2.7:** Rule Profiling Example Output
$\begin{figure}\footnotesize { \begin{verbatim}Rule Profile Statistics (worst 4... ...0.0 99.0 4 2580 1 29509 0 0 2660302 90.2 0.0 90.2\end{verbatim} }\end{figure}$

Configuration line used to print the above table: config profile_rules: print 4, sort total_ticks

The columns represent:

Number (rank)
Sig ID
Generator ID
Checks (number of times rule was evaludated after fast pattern match within portgroup or any-any rules)
Matches (number of times ALL rule options matched, will be high for rules that have no options)
Alerts (number of alerts generated from this rule)
CPU Ticks
Avg Ticks per Check
Avg Ticks per Match
Avg Ticks per Nonmatch

Interpreting this info is the key. The Microsecs (or Ticks) column is important because that is the total time spent evaluating a given rule. But, if that rule is causing alerts, it makes sense to leave it alone.

A high Avg/Check is a poor performing rule, that most likely contains PCRE. High Checks and low Avg/Check is usually an any-any rule with few rule options and no content. Quick to check, the few options may or may not match. We are looking at moving some of these into code, especially those with low SIDs.

Next: Preprocessor Profiling Up: Rule Profiling Previous: Examples Contents

Steven Sturges 2008-04-01