[Snort-sigs] Question on fast_pattern

Todd Wease twease at ...435...
Fri Oct 16 09:26:01 EDT 2009

All uri/http buffer contents will be added to the fast pattern matcher. 
  For each port group, there are potentially two fast pattern matchers - 
one for http contents and one for regular contents.  Because more than 
one http buffer can be used as the input string to the fast pattern 
matcher, all http contents are added to that fast pattern matcher, 
instead of having a fast pattern matcher for each http content.

On 10/12/2009 10:38 AM, Anoop Saldanha wrote:
> Hi,
> I wanted to know if fast_pattern can be used as a modifier along with
> uricontent.  Thanks for taking time to read this.  Please redirect me if
> I posted this question in the wrong list.
> --
> Thanks,
> Anoop Saldanha
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

More information about the Snort-sigs mailing list