Performance issues

False positives — Large numbers of false positives could (in severe cases) overwhelm the Manager. More commonly, they will simply overwhelm the user due to volume and speed of appearance.

Too many pattern matches — If the pattern your signature searches for occurs too often in the network traffic being analyzed, checking each match to determine whether it fulfills a signature condition may degrade Sensor performance.

Note

The most common cause of overwhelming numbers of pattern matches is making them too short. A pattern to be matched should never be shorter than 3 characters because the likelihood of a chance occurrence of such a pattern in normal traffic is very high.

Too many fixed-field tests — If you configure too many fixed-field tests in your signatures, Sensor performance may be degraded. This is due to the fact that the Sensor will have to inspect this field in every packet of the traffic type being tested. As with pattern matches, checking each test result to see if it fulfills a signature condition may affect Sensor performance.

Note

The Fixed Field test will have a performance impact as every packet needs to get inspected for all the conditions configured by the admin. Therefore, the Sensor performance degrade due to the Fixed Field Tests is directly proportional to the number of fixed field test instructions configured. Trellix recommends to factor in the performance degrade while configuring the Fixed Field Tests in your signatures.

Testing overly common fields — If your signature contains a test of a field that occurs very often in the traffic type being analyzed, it might degrade Sensor performance. This can be due to the number of tests that will be performed, or due to the number of tests that must be checked for fulfilling a signature test condition.