[Snort-users] where does Boyer-Moore Pattern Match Algorithm used in current Snort?

jiangzhw2008 jiangzhw2008 at ...14518...
Fri Apr 10 20:52:22 EDT 2009


Dear all,
      I saw such sentences in "Snort user manual"(version for 2.7.0,July 16, 2007):
"Whenever a content option pattern match is performed, the Boyer-Moore pattern match function is called and the (rather computationally expensive) testis performed against the packet contents."
     1.Does it mean that the BM search method is still used in snort?As we know, snort currently uses the  AC-BNFA as default pattern matching algorithm.
     2.There is a option named "lowmem" for search mehod ,then what is the algorithm used for lowmem and which file is it in the src?
    Thanks a lot!
    Best   reagards!
    jiangzhw2008 at ...14518...

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090411/5680a75c/attachment.html>


More information about the Snort-users mailing list