Non-content matching. OTN before RTN?

[Jaykumar Gosar <jaykumargosar () yahoo com>]

Hi all,

In Snort 2.0, in the non-content matching stage (as
understood from the code), OTN checking is done first.
If there is an OTN match, RTN is checked for
validation. I want to know why this change from older
RTN-then-OTN checking. It seems to me that
RTN-then-OTN would be more efficient and intuitive. 

Any explaination/views on the reasoning behind this
would be helpful.

Thanks in advance.

Jaykumar Gosar
Student, College of Computing
Georgia Tech


__________________________________
Do you Yahoo!?
The New Yahoo! Shopping - with improved product search
http://shopping.yahoo.com


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users