[Snort-users] Re: [Snort-sigs] Overhead caused by PCRE?

On Mon, Feb 28, 2005 at 05:22:43PM -0800, Jeff McCarthy wrote:
> I have a question regarding using PCRE in Snort rules. If I write
> 100 rules using content: and 100 using PCRE, will there be a
> noticable difference in processing time or CPU utilization?

Yes & No. I'll try to explain with the 4 different cases I come
across on a regular basis.

1) single rule, single string match

In the single rule string match case, both PCRE & content use
boyer-moore. However, pcre has a small amount of additional
function call overhead, giving content a slight win. However, in
most cases the additional overhead is negligible.

2) multiple single string match

If all the rules are doing is a simple string match, pcre will win
by a long shot if implemented as a single combined pcre statement.

While the multi-pattern match engine in Snort can be faster, the
additional function call overhead of evaluating multiple rules
makes pcre the clear winner.

This implementation has the drawback of Snort only generating a
single message for all of the patterns that make up the pcre. This
method should only be used when this drawback is acceptable.

See virus.rules for an example for an example of a "optomized"
combined pcre statement.

3) multiple rules, single string match and other detection plugins

content wins here, same as in the single rule single content.
Multiple pcre statements are slower than multiple contents.

4) multiple rules, complex pattern match

If the string match is more complicated than what can be
implemented with "strcmp", then pcre is the only way to go.
content can't do complicated pattern matching, so pcre is the only
method available. As such pcre wins.

Brian


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users