Snort mailing list archives

where does Boyer-Moore Pattern Match Algorithm used in current Snort?


From: jiangzhw2008 <jiangzhw2008 () yeah net>
Date: Fri, 10 Apr 2009 22:16:05 +0800 (CST)

Dear all,
      I saw such sentences in "Snort user manual"(version for 2.7.0,July 16, 2007):
"Whenever a content option pattern match is performed, the Boyer-Moore pattern match function is called and the (rather 
computationally expensive) testis performed against the packet contents."
     1.Does it mean that the BM search method is still used in snort?As we know, snort currently uses the  AC-BNFA as 
default pattern matching algorithm.
     2.There is a option named "lowmem" for search mehod ,then what is the algorithm used for lowmem and which file is 
it in the src?
    Thanks a lot!
    Best   reagards!
    jiangzhw2008 () yeah net

------------------------------------------------------------------------------
This SF.net email is sponsored by:
High Quality Requirements in a Collaborative Environment.
Download a free trial of Rational Requirements Composer Now!
http://p.sf.net/sfu/www-ibm-com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: