[prev in list] [next in list] [prev in thread] [next in thread]
List: snort-users
Subject: Re: [Snort-users] TCP stream processing performance
From: Kevin Wang <kevin.wang () Istuary ! com>
Date: 2016-06-28 12:55:40
Message-ID: CY1PR1201MB095646236360530D147528FB8A220 () CY1PR1201MB0956 ! namprd12 ! prod ! outlook ! com
[Download RAW message or body]
Thank you, Victor and Albert!
Is the flushing taking a lot of CPU time? The time spent (shown in the performance \
profile) is mostly on memory operation rather than CPU calculation, right?
Not sure if I expressed it clearly. The background is that I am currently starting to \
do some research on improving the overall intrusion detection performance and if \
necessary, we can use hardware acceleration on the processing. I know we can do some \
thing on the pattern matching side with extra hardware like TCAMs. However, for the \
preprocessor part, is there any way/need to improve it using extra special hardware \
other than more memory and processors?
Best Regards,
Kevin
From: Victor Roemer [mailto:viroemer@cisco.com]
Sent: June 27, 2016 10:33 PM
To: snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] TCP stream processing performance
Hi Kevin,
You are correct, while there are additional overheads such as host tcp state \
emulation, preprocessor alerts and stream normalizations probably accurate to say \
that the actual reassembled packet flushing etc.. is the most intensive. On 6/27/16 \
5:59 PM, Kevin Wang wrote: Hello,
I am looking at Snort performance and I found that in the Preprocessor profile \
statistics, "s5" or "s5tcp" is taking a lot of time. My understanding is that s5tcp \
is for TCP stream reassembly and the time taking is mostly due to the buffering and \
mis-ordered packets. The actually processing by the CPU is relatively short. Is my \
understanding correct or there is other intense processing going on?
Thanks,
Kevin
Email Disclaimer & Confidentiality Notice
This message is confidential and intended solely for the use of the recipient to whom \
they are addressed. If you are not the intended recipient you should not deliver, \
distribute or copy this e-mail. Please notify the sender immediately by e-mail and \
delete this e-mail from your system. Copyright (c) 2016 by Istuary Innovation Labs, \
Inc. All rights reserved.
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net<mailto:Snort-users@lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Email Disclaimer & Confidentiality Notice
This message is confidential and intended solely for the use of the recipient to whom \
they are addressed. If you are not the intended recipient you should not deliver, \
distribute or copy this e-mail. Please notify the sender immediately by e-mail and \
delete this e-mail from your system. Copyright (c) 2016 by Istuary Innovation Labs, \
Inc. All rights reserved.
[Attachment #3 (text/html)]
<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;
mso-fareast-language:EN-CA;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;
mso-fareast-language:EN-CA;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.msopapdefault, li.msopapdefault, div.msopapdefault
{mso-style-name:msopapdefault;
mso-margin-top-alt:auto;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:0cm;
line-height:106%;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;
mso-fareast-language:EN-CA;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;
mso-fareast-language:EN-US;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle24
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-CA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Thank you, Victor and Albert! <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is the flushing taking a lot of CPU time? The time spent (shown \
in the performance profile) is mostly on memory operation rather than CPU \
calculation, right? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Not sure if I expressed it clearly. The background is that I am \
currently starting to do some research on improving the overall intrusion detection \
performance and if necessary, we can use hardware acceleration on the processing. I \
know we can do some thing on the pattern matching side with extra hardware like \
TCAMs. However, for the preprocessor part, is there any way/need to improve it using \
extra special hardware other than more memory and processors? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Best Regards, <o:p>
</o:p></span></p>
<p class="MsoNormal"><span \
style="mso-fareast-language:EN-CA">Kevin<o:p></o:p></span></p> <p \
class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p> <p \
class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p> <div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" \
style="color:windowtext;mso-fareast-language:EN-CA">From:</span></b><span \
lang="EN-US" style="color:windowtext;mso-fareast-language:EN-CA"> Victor Roemer \
[mailto:viroemer@cisco.com] <br>
<b>Sent:</b> June 27, 2016 10:33 PM<br>
<b>To:</b> snort-users@lists.sourceforge.net<br>
<b>Subject:</b> Re: [Snort-users] TCP stream processing \
performance<o:p></o:p></span></p> </div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Hi Kevin,<span style="font-size:12.0pt;mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p><o:p> </o:p></p>
<p>You are correct, while there are additional overheads such as host tcp state \
emulation, preprocessor alerts and stream normalizations probably accurate to say \
that the actual reassembled packet flushing etc.. is the most \
intensive.<o:p></o:p></p> <div>
<p class="MsoNormal">On 6/27/16 5:59 PM, Kevin Wang wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hello, <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I am looking at Snort performance and I found that in the \
Preprocessor profile statistics, “s5” or “s5tcp” is taking a \
lot of time. My understanding is that s5tcp is for TCP stream reassembly and the time \
taking is mostly due to the buffering and mis-ordered packets. The actually \
processing by the CPU is relatively short. Is my understanding correct or there is \
other intense processing going on? <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Thanks, \
</span><o:p></o:p></p> <p class="MsoNormal"><span \
style="mso-fareast-language:EN-CA">Kevin</span><o:p></o:p></p> <p \
class="MsoNormal"><b><span \
style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#7F7F7F">Email \
Disclaimer & Confidentiality Notice</span></b><o:p></o:p></p> <p \
class="MsoNormal"><span \
style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#979898">This \
message is confidential and intended solely for the use of the recipient to whom they \
are addressed. If you are not the intended recipient you should not deliver, \
distribute or copy this e-mail. Please notify the sender immediately by e-mail and \
delete this e-mail from your system. Copyright © 2016 by Istuary Innovation \
Labs, Inc. All rights reserved. </span><o:p></o:p></p> <p \
class="MsoNormal"> <o:p></o:p></p> <p class="MsoNormal"><span \
style="font-size:12.0pt;font-family:"Times New \
Roman",serif;mso-fareast-language:EN-CA"><br> <br>
<br>
<o:p></o:p></span></p>
<pre>------------------------------------------------------------------------------<o:p></o:p></pre>
<pre>Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in \
San<o:p></o:p></pre> <pre>Francisco, CA to explore cutting-edge tech and listen to \
tech luminaries<o:p></o:p></pre> <pre>present their vision of the future. This family \
event has something for<o:p></o:p></pre> <pre>everyone, including kids. Get more \
information and register today.<o:p></o:p></pre> <pre><a \
href="http://sdm.link/attshape">http://sdm.link/attshape</a><o:p></o:p></pre> <p \
class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New \
Roman",serif;mso-fareast-language:EN-CA"><br> <br>
<br>
<o:p></o:p></span></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Snort-users mailing list<o:p></o:p></pre>
<pre><a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a><o:p></o:p></pre>
<pre>Go to this URL to change user options or unsubscribe:<o:p></o:p></pre>
<pre><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a><o:p></o:p></pre>
<pre>Snort-users list archive:<o:p></o:p></pre>
<pre><a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users">htt \
p://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><o:p></o:p></pre> \
<pre><o:p> </o:p></pre> <pre>Please visit <a \
href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the \
latest Snort news!<o:p></o:p></pre> </blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New \
Roman",serif;mso-fareast-language:EN-CA"><o:p> </o:p></span></p> </div>
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:??;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@??";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{font-family:"Calibri",sans-serif;}
.MsoPapDefault
{margin-bottom:8.0pt;
line-height:107%;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<div class="WordSection1">
<p class="MsoNormal"><b><span \
style="font-size:7.5pt;font-family:"Arial",sans-serif; color:#7F7F7F">Email \
Disclaimer & Confidentiality Notice</span></b><span \
style="color:black"><u1:p></u1:p></span></p> <p class="MsoNormal"><span \
style="font-size:7.5pt;font-family:"Arial",sans-serif; color:#979898">This \
message is confidential and intended solely for the use of the recipient to whom they \
are addressed. If you are not the intended recipient you should not deliver, \
distribute or copy this e-mail. Please notify the sender immediately by e-mail and \
delete this e-mail from your system. Copyright © 2016 by Istuary Innovation \
Labs, Inc. All rights reserved. </span></p> <p class="MsoNormal"> </p>
</div>
</body>
</html>
[Attachment #4 (--===============8362462510051519265==)]
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
Please visit http://blog.snort.org to stay current on all the latest Snort news!
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic