[Snort-devel] Pattern matching

Marc Norton marc.norton at ...402...
Wed Dec 3 09:21:01 EST 2003


We have a wu manber and an aho corasick pattern matcher in snort now.
You can use 'config detect: search-method mwm' for wu manber or use 'ac'
instead of 'mwm' for aho corasick.  If you want to patch in your own,
study mpse.c ...
 
Marc Norton - Senior Software Engineer
marc.norton at ...402...
 
-----Original Message-----
From: snort-devel-admin at lists.sourceforge.net
[mailto:snort-devel-admin at lists.sourceforge.net] On Behalf Of Ragip
Yahsieli
Sent: Monday, December 01, 2003 9:29 AM
To: snort-devel at lists.sourceforge.net
Subject: [Snort-devel] Pattern matching
 
How can I change snort's pattern matching algorithm. coz boyer-moore
algorithm is very slow in respect to wu manber and exclusion based
algorithm which was performed by professors of crete university? does
anyone have any idea about changing this pattern matching? 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20031203/596a3ea3/attachment.html>


More information about the Snort-devel mailing list