[Snort-users] Does Boyer-Moore Pattern Match Algorithm Still being used in current Snort?

jiangzhw2008 jiangzhw2008 at ...14518...
Sat Apr 11 13:08:48 EDT 2009


Dear all,
      I saw such sentences in "Snort user manual"(version for 2.7.0,July 16, 2007):
"Whenever a content option pattern match is performed, the Boyer-Moore pattern match function is called and the (rather computationally expensive) testis performed against the packet contents."
     1.Does it mean that the BM search method is still used in snort?As we know, snort currently uses the  AC-BNFA as default pattern matching algorithm.
     2.There is a option named "lowmem" for search mehod ,then what is the algorithm used for lowmem and which file is it in the src?
    Thanks a lot!
    Best   reagards!
    jiangzhw2008 at ...14518...

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090412/ac51deaa/attachment.html>


More information about the Snort-users mailing list