Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

intrusion detection: multi-pattern matcher option #1050

Closed
fichtner opened this issue Jul 5, 2016 · 6 comments
Closed

intrusion detection: multi-pattern matcher option #1050

fichtner opened this issue Jul 5, 2016 · 6 comments
Assignees
@AdSchellevis
Labels
feature Adding new functionality
Milestone
16.7

Comments

@fichtner
Copy link
Member

fichtner commented Jul 5, 2016 •
edited
Loading

Hi Ad,

Hyperscan support is coming to our Suricata 3.1, for that we need to set something in suricata.yaml:

mpm-algo: hs

The current default is: "ac" (Aho-Corasick)
The new option is: "hs" (Hyperscan)

For this we need a select box in the GUI.

Cheers,
Franco
@fichtner fichtner added the feature Adding new functionality label Jul 5, 2016
@fichtner fichtner added this to the 16.7 milestone Jul 5, 2016
@fichtner fichtner assigned fichtner and AdSchellevis and unassigned fichtner Jul 5, 2016
@L1ghtn1ng
Copy link

Will hyperscan be able to run on an a10? Also with 16.7 is it going to be the default now?

@fichtner
Copy link
Member Author

fichtner commented Jul 5, 2016

yes. no. I'm unsure how / if this performs on i386.

@L1ghtn1ng
Copy link

Well the a10 is 64 bit so that is fine for me as I will not have to worry about that

@L1ghtn1ng
Copy link

But would be awesome if this can become the default though

@fichtner
Copy link
Member Author

fichtner commented Jul 5, 2016

I know, but there are others and this is free software for many platforms. According to the website below, 32 bit is fine.

http://www.intel.com/content/www/us/en/communications/hyperscan.html

It doesn't need to be a default. We start shipping the support, the setting will be permanent. Done. :)

@L1ghtn1ng
Copy link

Awesome and performance for the win while maintaining security I like it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@AdSchellevis AdSchellevis

Labels
feature Adding new functionality
Milestone
16.7
Development

No branches or pull requests
3 participants
@fichtner @L1ghtn1ng @AdSchellevis