Innovation -- You Keep Using That Word...
Summary: Cisco Talos ran Snort and Suricata on the same commodity hardware with the latest VRT open-source ruleset, and Suricata dropped 58% of 30 million packets in one test set and 52% in a second with hyperthreading disabled, against Snort's 0.0204% and 0.0017%. An internal VRT report found Suricata peaked at about 300 Mb/s without rules and about 200 Mb/s with rules, while Snort hit 894 Mb/s with no drops.
Why it matters: The OISF spent nearly a million dollars of DHS money on an engine that, on the same box and ruleset, dropped more than half the traffic it was given - and its decision to skip an obfuscated or .so rule format caps detection at its own rule language, which the author calls an unacceptable limitation for complex environments and TS/SCI work.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026