Snort mailing list archives
Non-content matching. OTN before RTN?
From: Jaykumar Gosar <jaykumargosar () yahoo com>
Date: Tue, 14 Oct 2003 21:42:08 -0700 (PDT)
Hi all, In Snort 2.0, in the non-content matching stage (as understood from the code), OTN checking is done first. If there is an OTN match, RTN is checked for validation. I want to know why this change from older RTN-then-OTN checking. It seems to me that RTN-then-OTN would be more efficient and intuitive. Any explaination/views on the reasoning behind this would be helpful. Thanks in advance. Jaykumar Gosar Student, College of Computing Georgia Tech __________________________________ Do you Yahoo!? The New Yahoo! Shopping - with improved product search http://shopping.yahoo.com ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Non-content matching. OTN before RTN? Jaykumar Gosar (Oct 14)