[Snort-sigs] SID 663, SMTP rcpt to sed command attempt

Matt Kettler mkettler at ...189...
Mon Jul 14 13:40:07 EDT 2003


At 04:21 PM 7/14/2003 -0400, Brian wrote:
>Once pcre is accepted, then you won't need that type of hack.

True, you could do all of that quite easily as a regex.

Speaking of pcre, how's the performance impact of that looking? I know 
there were a lot of hesitations over performance concerns, and then some 
later discussions of how to speed it up, but I've not heard anything since. 
Anyone been playing with it lately?

It'd be great to have regex rules, but it'd also have to not be orders of 
magnitude slower to do em.





More information about the Snort-sigs mailing list