Snort mailing list archives
Re: PCRE in snort
From: lists () packetmail net
Date: Thu, 30 Jun 2016 09:41:11 -0500
On 06/30/16 08:37, Joel Esler (jesler) wrote:
Yes. Not recommended, but yes.
I've done it in the past, but it's usually a fairly rare occurrence. The PCRE engine can be a performance drain so if you're doing this I would recommend having strong content match "anchors" and potentially using the /R PCRE flag as well. Cheers, Nathan ------------------------------------------------------------------------------ Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San Francisco, CA to explore cutting-edge tech and listen to tech luminaries present their vision of the future. This family event has something for everyone, including kids. Get more information and register today. http://sdm.link/attshape _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- PCRE in snort Fincham, Greg L. CTN2 (Jun 30)
- Re: PCRE in snort Joel Esler (jesler) (Jun 30)
- Re: PCRE in snort lists (Jun 30)
- Re: PCRE in snort Joel Esler (jesler) (Jun 30)