Re: [Snort-devel] New feature wanted: Rule matching stats

From: Martin Olsson <elof(at)sentor.se>
Date: Mon Jul 07 2003 - 08:21:19 EDT

On 3 Jul 2003, Gianni Tedesco wrote:
> On Thu, 2003-06-26 at 11:43, Roy S. Rapoport wrote:

Exactly.

> This is a cool idea and one I have ruminated on for a while. I think the

I don't know if that is possible, that's why I only asked for the feature to dump statistics, and then manually optimize the rules.

Isn't the _order_ of rules loaded important? If I have a rule matching "C:\WINNT\SYSTEM32" and another one matching only "C:\", I don't want the latter to be moved in front of the first by an optimizing routine... :)

/Martin

---

This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Mon Jul 7 08:41:59 2003