<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1486253847744_29730"><span id="yui_3_16_0_ym19_1_1486253847744_29729">Can anyone answer my question? As I sad, I use Suricata-IDS on Windows and config part not have any part like that.</span></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Sunday, February 5, 2017 1:44 AM, Peter Manev <petermanev@gmail.com> wrote:<br></font></div> <br><br> <div class="y_msg_container"><br clear="none"><br clear="none">> On 4 Feb 2017, at 19:12, Cooper F. Nelson <<a shape="rect" ymailto="mailto:cnelson@ucsd.edu" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a>> wrote:<br clear="none">> <br clear="none">>> On 2/3/2017 7:03 AM, Peter Manev wrote:<br clear="none">>>> On Wed, Feb 1, 2017 at 11:28 PM, Cooper F. Nelson <<a shape="rect" ymailto="mailto:cnelson@ucsd.edu" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a>> wrote:<br clear="none">>>> I was using the automatic feature in the .yaml. I just explicitly<br clear="none">>>> defined it in the rules as well.<br clear="none">>> <br clear="none">>> Do you see any diff/improvement that way?<br clear="none">> <br clear="none">> I'm measuring performance as % packet drops over 24hs. Did not see any<br clear="none">> clear difference.<br clear="none">> <br clear="none">>>> Btw, I posted about this earlier, but I'm basically doing a 'prefilter'<br clear="none">>>> for doing file extraction by magic number by building a custom magic.mgc<br clear="none">>>> file. If you only build in the magic numbers you are interested in<br clear="none">>>> matching on it vastly improves performance (when using the filemagic<br clear="none">>>> keyword).<br clear="none">>> <br clear="none">>> Yes that is a cool trick. Did you see perf hit across the whole system<br clear="none">>> or just a subset of CPU(s)?<br clear="none">> <br clear="none">> Whole system. Suri is using one filemagic thread per detect thread.<br clear="none">> Matching magic numbers with hyperscan would be way better, but that's a<br clear="none">> tall order I think!<br clear="none">> <br clear="none"><br clear="none">Would be a good FR discussion on redmine :)<div class="yqt4328598575" id="yqtfd38984"><br clear="none"><br clear="none"><br clear="none">> -- <br clear="none">> Cooper Nelson<br clear="none">> Network Security Analyst<br clear="none">> UCSD ITS Security Team<br clear="none">> <a shape="rect" ymailto="mailto:cnelson@ucsd.edu" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042<br clear="none">> </div><br><br></div> </div> </div> </div></div></body></html>