Snort mailing list archives
where does Boyer-Moore Pattern Match Algorithm used in current Snort?
From: jiangzhw2008 <jiangzhw2008 () yeah net>
Date: Fri, 10 Apr 2009 22:16:05 +0800 (CST)
Dear all, I saw such sentences in "Snort user manual"(version for 2.7.0,July 16, 2007): "Whenever a content option pattern match is performed, the Boyer-Moore pattern match function is called and the (rather computationally expensive) testis performed against the packet contents." 1.Does it mean that the BM search method is still used in snort?As we know, snort currently uses the AC-BNFA as default pattern matching algorithm. 2.There is a option named "lowmem" for search mehod ,then what is the algorithm used for lowmem and which file is it in the src? Thanks a lot! Best reagards! jiangzhw2008 () yeah net
------------------------------------------------------------------------------ This SF.net email is sponsored by: High Quality Requirements in a Collaborative Environment. Download a free trial of Rational Requirements Composer Now! http://p.sf.net/sfu/www-ibm-com
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- where does Boyer-Moore Pattern Match Algorithm used in current Snort? jiangzhw2008 (Apr 10)
- <Possible follow-ups>
- where does Boyer-Moore Pattern Match Algorithm used in current Snort? jiangzhw2008 (Apr 10)