digg

Facebook Connect Join Digg About

Speeding up snort_inline IPS with kernel string matching

michaelrash.blogspot.com — Most iptables policies employ a "default QUEUE" stance when snort_inline is being used. This has the advantage of sending every packet to snort_inline, but this also comes at a price in terms of performance. By using fwsnort, you can change the "default QUEUE" stance to "only QUEUE if a packet contains malicious data".

Who dugg this?

Digg DudeWhat is Digg?

Digg is a place for people to discover and share content from anywhere on the web. Digg surfaces the best stuff as submitted and voted on by the community. Take the Tour to learn more.

1 Comments

show profanity settings
expand all
  • michaelrash, on 10/12/2007, -0/+0In some cases, using a policy built by fwsnort in this way can result in as much as a 57% performance boost in snort_inline. The link above has some performance numbers created with netperf to illustrate this.

  • Add a Comment

    Login or register to comment!
    Or, sign-in super fast with your Facebook account ...

© Digg Inc. 2009 — Content created and posted by Digg users is dedicated to the public domain | Terms of Use Updated | Privacy Policy
DIGG, DIGG IT, DUGG, DIGG THIS, Digg graphics, logos, designs, page headers, button icons, scripts, and other service names are the trademarks of Digg Inc.