Re: Rule Load Formula

> Something I've considered doing before and found to be more work that I
> had resources to do, was to make an average traffic corpus and some kind
> of framework to do the testing. Tools like tomahawk exist, but aren't
> complete for this. There needs to be a very detailed statistical
> analysis behind the testing.
>  
This would indeed be very interesting. Even if, in the end, you 
determined that the performance numbers you get out of this "average" 
traffic were marginally reliable at best, having a large body of sample 
traffic to test rules with would be exceedingly helpful in a lot of 
circumstances. I would think that you'd want constant additions to the 
pool of PCAPs, so that you get a better sample of the real world, and so 
that you don't fall into traps based on the type of traffic you once 
collected and have been using for some time.

I think the biggest obstacle to something like this isn't even so much 
time as it is privacy. I could sit around and collect PCAPs on some of 
my personal and/or work boxes all day long, but I'd have to sift through 
them to remove private e-mail text, any cleartext-submitted passwords, 
etc. that I didn't want the rest of the universe to see. More 
imporantly, I'd feel like I needed the consent of everyone whose traffic 
I captured before publishing a PCAP. Got any thoughts on this angle of 
such a collection?

Alex Kirk