[Snort-devel] full-regex pattern match

Burak DAYIOGLU dayioglu at ...287...
Wed May 9 14:16:07 EDT 2001

Brian Caswell wrote:
> I'm willing to bet that once existing regex tag actually WORKS (HINT,
> HINT... POKE POKE.  MAKE IT GO!!!) it will be much faster.  Our
> current iteration of regex only supports ? and *.  Thats good for most
> things, and is still fairly fast.

A full regexp engine would make Snort deadly slow. Simpler regexps, as
the one Brian refers will be far more faster...


More information about the Snort-devel mailing list