Monday, February 28, 2005

Profiling Snort



1. change "configure" by adding "-pg" to the line: CFLAGS="-O2 -pg"
2. run the program for a while and then CTRL-C it. The signal handlers will ensure that snort
exits gracefully.

NOTE: you have to make sure you are using a suitable set of rules. This is the MOST important part
of this test since this will determine whether or not rule patter matching is used and to what extent.

Snort looks for either /etc/snort.conf or ./snort.conf. If your config lives elsewhere,
use the -c option to specify a valid config-file:

snort -c WHEREEVER/snort.conf

3. gprof snort [gmon.out] > snort.out