[Snort-devel] AC_BM

tlewis at ...255... tlewis at ...255...
Sun Jan 13 18:55:02 EST 2002


On Sun, 13 Jan 2002 tlewis at ...255... wrote:

> The string examinations within an ACBM stage have to procede in the
> opposite direction from the direction of traversal.  So, if you want
> to use strcmp and friends, which procede from left-to-right, then your
> overall direction of travel has to be right-to-left.
> 
> In Hank's ACBM implementation, I wrote my own strcmp's that procede rtl;
> my reasoning is that I want to be able to search on unbounded streams,
> and that necessitates forward-progressing searches.

Wow, it's funny how a few months can make you a non-expert on your
own code!  The general explanation holds, but hank's implementation is,
uhh, subtle.

--
Todd Lewis
tlewis at ...255...

Q: How many marxists does it take to screw in a lightbulb?
A: None - the bulb contains the seeds of its own revolution. 





More information about the Snort-devel mailing list