fast_pattern

Snort's fast pattern matcher is crucial for performance, as it helps determine which packets qualify for the additional processing that comes with rule option evaluation. At a high-level, the fast pattern engine uses a single content match from a rule and evaluates it against the packet to determine if further rule processing should continue against the traffic. The ideal fast pattern is one which, if found, is very likely to result in a rule match. Fast patterns that match frequently against unrelated traffic will cause Snort to work hard with little to show for it.

Fast pattern matches are either explicitly set with the fast_pattern option or set automatically to the longest content match if the option is not specified. However, it's important to keep in mind that the longest pattern is sometimes not the most unique, and so one can add the fast_pattern modifier to a content option to maximize performance.

During rule evaluation, the content string selected as the fast_pattern match will automatically be skipped if possible. This is a change from Snort 2. Previously, users would have to specify fast_pattern:only to evaluate a fast_pattern match only once; Snort 3 now intelligently evaluates the fast_pattern match only once if it is able.

Note: Certain buffers are not eligible to contain fast_pattern content matches, and those include the following: http_raw_cookie, http_param, http_raw_body, http_version, http_raw_request, http_raw_status, http_raw_trailer, and http_true_ip.

Format:

fast_pattern

Example:

content:"super_secret_encryption_key",fast_pattern;

fast_pattern_offset, fast_pattern_length

Users can also specify that only a portion of a content match be used as as fast_pattern. This is specified with two modifiers, fast_pattern_offset and fast_pattern_length. The former sets the number of leading characters of this content the fast pattern should exclude, while the latter sets the number of characters from this content to include in the fast pattern matcher. Valid values are 0:65535 and 1:65535 for offset and length, respectively.

Format:

fast_pattern_offset offset, fast_pattern_length length

Example:

# Only the "/not_a_cnc_endpoint.php" portion of the match is used as the fast pattern
content:"/index/not_a_cnc_endpoint.php",fast_pattern_offset 6,fast_pattern_length 23;

This above option will, however, still evaluate the full content match normally as long as the fast pattern check is successful.