[Snort-devel] full-regex pattern match

Thomas Whipp tkw at ...415...
Wed May 9 11:17:42 EDT 2001


perhaps this would be more appropriate as a post-processor -
it wouldn't need to process all packets (just those that
originally got trapped) and speed would not be such a
priority.

	Tom

> -----Original Message-----
> From: Burak DAYIOGLU [mailto:dayioglu at ...287...]
> Sent: 09 May 2001 19:16
> To: snort-devel at lists.sourceforge.net
> Subject: Re: [Snort-devel] full-regex pattern match
> 
> 
> Brian Caswell wrote:
> > I'm willing to bet that once existing regex tag actually

> WORKS (HINT,
> > HINT... POKE POKE.  MAKE IT GO!!!) it will be much
faster.  Our
> > current iteration of regex only supports ? and *.  Thats

> good for most
> > things, and is still fairly fast.
> > 
> 
> A full regexp engine would make Snort deadly slow. Simpler
regexps, as
> the one Brian refers will be far more faster...
> 
> regards,
> -bd
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel
> 




More information about the Snort-devel mailing list