[Snort-devel] DFA construction in Snort

Maleeha N beenish.raza at ...445...
Sun Sep 22 03:35:57 EDT 2013

 I have heard that snort makes DFAs on real time. What does it mean by real time? Shouldn't the DFAs be built before the packets arrive? Like if we have a regular expression defined for some attack then its DFA should already be there before the packet comes. So, that when such packet arrives then the packet with that particular attack be identified on urgent basis.  		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20130922/4e26d957/attachment.html>

More information about the Snort-devel mailing list