Recommendations for writing good rules

In this section, we will look at a few of the tips or recommendations for writing good Snort rules.

Using fast_pattern wisely

The use of fast_pattern is a key factor that affects the Snort’s runtime performance. The right or wrong choice of fast_pattern can have an impact on the performance of Snort.

Choosing the most unique pattern for fast_pattern is very crucial. If the pattern that is chosen as the fast_pattern is not unique but rather very common, then the pattern will always match all traffic and will result in unnecessary evaluation of the rule.

Using the inspection buffers for rule matching

When the pattern that we are looking for is available in an inspection buffer, always search in the buffer rather than the entire packet payload. Since the buffer will contain a subset of the entire packet payload, the efficiency of the search will be improved.

Defining the right service or protocol

Always write rules for...