[Snort-users] What are the possible search-method directives?

JP Vossen vossenjp at ...8683...
Mon May 5 09:25:05 EDT 2003


On Mon, 5 May 2003, Erek Adams wrote:

> On Mon, 5 May 2003, JP Vossen wrote:
>
> > Anyone know what the different "config detection: search-method"s are?
>
> ac:  Aho-Corasick based algorithm
> mwm:  Mu-Wanber based algorithm
> lowmem:  Save memory, using an less effecient algorithm
>
> http://marc.theaimsgroup.com/?l=snort-devel&m=103427225029674&w=2

Sorry, missed that (only searched Snort-Users, duh).  Is mwm the "default" if
you do not specify anything then?


> Not confused, you just looked in the wrong place.  Check fpcreate.c:

I'm not surprised. :-)


>    200     Search method is set using "config detect: search-method ac |
>    200  mwm | auto"

But when I tried to use "auto" as in:
	config detection: search-method auto

Snort barfed on startup,so I assume I am misunderstanding something.


Thanks for your clarification,
JP
------------------------------|:::======|--------------------------------
JP Vossen, CISSP              |:::======|                jp at ...8684...
My Account, My Opinions       |=========|       http://www.jpsdomain.org/
------------------------------|=========|--------------------------------
"The software said it requires Windows 98 or better, so I installed
Linux..."





More information about the Snort-users mailing list