[Snort-sigs] SID 663, SMTP rcpt to sed command attempt
mkettler at ...189...
Mon Jul 14 13:40:07 EDT 2003
At 04:21 PM 7/14/2003 -0400, Brian wrote:
>Once pcre is accepted, then you won't need that type of hack.
True, you could do all of that quite easily as a regex.
Speaking of pcre, how's the performance impact of that looking? I know
there were a lot of hesitations over performance concerns, and then some
later discussions of how to speed it up, but I've not heard anything since.
Anyone been playing with it lately?
It'd be great to have regex rules, but it'd also have to not be orders of
magnitude slower to do em.
More information about the Snort-sigs