Snort 'ignore_call_channel' setting seems to have no effect
-
Greetings. I am a recent convert to pfSense (using 2.1 RC0 amd64 daily snapshot) , and I have a fundamental question on Snort's SIP preprocessor. In essence, I expected the 'ignore_call_channel' setting to instruct snort not to process media transported over RTP in a SIP session. Based on my limited experience so far, I can't explain the fact that, in a single VoIP call, snort process takes up roughly 10% of CPU time throughout the call. If I have to take a guess, snort is busy processing RTP packets even though the config says otherwise. If anybody is able shed some light on this issue, it'll be much appreciated.
Thanks a lot.
-
Based on my research, the options that work well in this case are 1) Disable UDP tracking in Stream5 2) or define a BPF filter file using a 'config' option called 'bpf_file'. Since disabling UDP tracking altogether may not be desired, I am sticking with BPF. I hope this information helps someone in the future.