Describes features for improving system performance while analyzing traffic for attempted intrusions.
Intrusion prevention performance tuning is a system optimization mechanism that
-
improves performance while analyzing traffic for attempted intrusions,
-
applies settings on a per-access control policy basis to all intrusion policies invoked by that parent access control policy, and
-
balances security with the need to maintain device latency at an acceptable level.
Performance tuning features
Cisco provides several features for improving the performance of your system as it analyzes traffic for attempted intrusions. You can:
-
specify the number of packets to allow in the event queue. You can also, before and after stream reassembly, enable or disable inspection of packets that will be rebuilt into larger streams.
-
override default match and recursion limits on PCRE that are used in intrusion rules to examine packet payload content.
-
elect to have the rules engine log more than one event per packet or packet stream when multiple events are generated, allowing you to collect information beyond the reported event.
-
balance security with the need to maintain device latency at an acceptable level with packet and rule latency thresholding.
-
configure the basic parameters of how devices monitor and report their own performance. This allows you to specify the intervals at which the system updates performance statistics on your devices.
Snort 2 is not supported on threat defense version 7.7. For information on Snort 2 features that are supported in versions earlier than 7.7, refer to the Firewall Management Center guide that matches your Firewall Threat Defense version.