Re: SNORT Testing

sshamay@xxxxxxxxxxxxxxxx wrote:
We are doing some performance tests on “snort” .

Good luck !

The tests are focused on measuring the throughput rates of snort under different mixture of traffic (good traffic + a percentage of malicious traffic)

"I have no idea which is a good performance measure for an IDS, but I
have an exact idea which ISN'T the right one: packets per second".

I am citing from memory, so I might be wrong, but this is a famous quote
by Marcus Ranum, which I wholeheartedly adhere to.

I need your help, how should be the test environment, which tools to use etc.

You can see some tinkering on the matter from my presentation at Black
Hat Federal:

Cordiali saluti,
Stefano Zanero
Dottorando di Ricerca / Ph.D. Student

Politecnico di Milano - Dip. Elettronica e Informazione
E-mail: zanero@xxxxxxxxxxxxxx

Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
to learn more.