12-15-2014 02:52 PM - last edited on 03-25-2019 05:54 PM by ciscomoderator
if there is a signature's ip range not covered new victims' ip addresses in ISP,
is it a good practice to set source and destination ip with any ip ?
will it slow down the performance?
12-15-2014 06:59 PM
Hi,
It would depend more on the Signature Type. For ex:- If it is a TCP normalizer signature , it might affect the performance more than a ICMP signature.
Also , it would depend on the amount of traffic that would be matching this traffic.
Thanks and Regards,
Vibhor Amrodia
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide
Log in to Community