Enabled Parsers with No Traffic Load

Zeek
1

Hi,

I apologise if this is a dumb question: if I run Zeek with all of the GitHub - cisagov/ICSNPP: Industrial Control Systems Network Protocol Parsers installed and enabled but no traffic is seen for any of the said parsers, do we still incur an extra load on Zeek?

2

Some of this depends on the exact analyzer and how it is activated.

  • if it is activated by a port that sees no traffic there should be almost no additional work
  • if it is activated by a DPD signature some work would happen in the DPD framework to (unsuccessfully) match the signature

Once a analyzer was activated by Zeek it would be fed traffic. If it is implemented correctly and there is no matching traffic it would analyze the provided data and at some point reject further input. The additional work this would incur depends on how quickly the analyzer can detect that the traffic does not match.

While you should be able to see some of this by inspecting the analyzer’s code, the safest bet is to benchmark a system with and without it on the same traffic.

1 Like
3

Thank you so much again for the excellent response.

1 Like