Snort mailing list archives
Re: Question on fast_pattern
From: Todd Wease <twease () sourcefire com>
Date: Fri, 16 Oct 2009 09:26:01 -0400
All uri/http buffer contents will be added to the fast pattern matcher. For each port group, there are potentially two fast pattern matchers - one for http contents and one for regular contents. Because more than one http buffer can be used as the input string to the fast pattern matcher, all http contents are added to that fast pattern matcher, instead of having a fast pattern matcher for each http content. On 10/12/2009 10:38 AM, Anoop Saldanha wrote:
Hi, I wanted to know if fast_pattern can be used as a modifier along with uricontent. Thanks for taking time to read this. Please redirect me if I posted this question in the wrong list. -- Thanks, Anoop Saldanha ------------------------------------------------------------------------------ Come build with us! The BlackBerry(R) Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9 - 12, 2009. Register now! http://p.sf.net/sfu/devconference _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
------------------------------------------------------------------------------ Come build with us! The BlackBerry(R) Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9 - 12, 2009. Register now! http://p.sf.net/sfu/devconference _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
Current thread:
- Question on fast_pattern Anoop Saldanha (Oct 12)
- Re: Question on fast_pattern Todd Wease (Oct 16)