[Snort-devel] Case sensitive fast pattern matches

Mike Cox mike.cox52 at ...2499...
Wed Mar 5 10:02:25 EST 2014


Dear Snort Community,

I will keep this "short and sweet".  For many years I have appreciated the
functionality of the Snort fast pattern matcher.  Yet I often wish (read:
strongly desire) that it would be case-sensitive, or at the very least,
have the capability to specify if a fast pattern match should be case
sensitive or not.

A case sensitive match should be more efficient that one that is not and a
lot of times, while I benefit from the overall performance enhancement from
the fast pattern matcher, the engine has to re-evaluate the content match
again because I need the match to be case sensitive so I can't set it as,
"fast_pattern:only".  This is very frustrating (hence this email).

Thanks!

Mike Cox
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20140305/a7d70c90/attachment.html>


More information about the Snort-devel mailing list