[Snort-users] PCRE

adam.w.hogan adam.w.hogan at ...9362...
Fri Dec 19 11:21:01 EST 2003


Does using pcre in signatures tax the CPU?  When is it proper and/or efficient to use pcre?  I'm very familiar with perl regular expressions and it would be easier to write rules with pcre than content & distance, within, etc.  Is there a downside to using pcre for this? 

I suppose I ask because it sounds like too much of a good thing.  Between pcre and thresholding I think it will be a lot easier and far more efficient to write rules for Snort.

****************************************************************************************

Note: The information contained in this message may be privileged and confidential and thus protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.

****************************************************************************************




More information about the Snort-users mailing list