[Snort-devel] full-regex pattern match
tkw at ...415...
Wed May 9 11:17:42 EDT 2001
perhaps this would be more appropriate as a post-processor -
it wouldn't need to process all packets (just those that
originally got trapped) and speed would not be such a
> -----Original Message-----
> From: Burak DAYIOGLU [mailto:dayioglu at ...287...]
> Sent: 09 May 2001 19:16
> To: snort-devel at lists.sourceforge.net
> Subject: Re: [Snort-devel] full-regex pattern match
> Brian Caswell wrote:
> > I'm willing to bet that once existing regex tag actually
> WORKS (HINT,
> > HINT... POKE POKE. MAKE IT GO!!!) it will be much
> > current iteration of regex only supports ? and *. Thats
> good for most
> > things, and is still fairly fast.
> A full regexp engine would make Snort deadly slow. Simpler
> the one Brian refers will be far more faster...
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
More information about the Snort-devel