Snort Performance and IP-Only Rules
Summary: Cisco Talos notes that IP-only Snort rules, which lack a static content match for the fast pattern matcher, are evaluated by the main Snort engine on every packet crossing the IDS, and at production sites running hundreds or thousands of such rules the per-packet engine entry work consumes all available system resources. Snort 2.9.1, released in August of the prior year, added an IP reputation preprocessor that checks packet-header IP addresses against a blocklist or whitelist in memory, and sites that switched saw systems dropping up to 50% of packets begin processing everything smoothly.
What you should know: Sites that made the switch recovered from dropping up to 50% of their packets, which means the traffic they were blind to was lost to a configuration choice rather than a missing control.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026