PCRE

["adam.w.hogan" <adam.w.hogan () delphi com>]

Does using pcre in signatures tax the CPU?  When is it proper and/or efficient to use pcre?  I'm very familiar with 
perl regular expressions and it would be easier to write rules with pcre than content & distance, within, etc.  Is 
there a downside to using pcre for this? 

I suppose I ask because it sounds like too much of a good thing.  Between pcre and thresholding I think it will be a 
lot easier and far more efficient to write rules for Snort.

****************************************************************************************

Note: The information contained in this message may be privileged and confidential and thus protected from disclosure. 
If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this 
message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this 
communication is strictly prohibited. If you have received this communication in error, please notify us immediately by 
replying to the message and deleting it from your computer. Thank you.

****************************************************************************************


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users