Snort mailing list archives
Regarding pattern Matching
From: Govind <govind () ac upc edu>
Date: Fri, 16 Nov 2007 22:06:24 +0100
Hi all, I have written the Aho Corasick algorithm in C (corresponding to AC_FULL option in snort) as a part of my thesis. While running the Aho Corasick Algorithm with the snort rule set I noticed that while the Data structure (the tree like structure of the algo) consumes 53 MB the storage for the matched rules is 800 MB. Is this really the case or have I missed something. I tried running the acsmx.c file in the snort distribution with the snort rule set but the program is getting killed. Also in order to build the automaton I used the characters following the content keyword in the rules. Thanking You Regards Govind ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Regarding pattern matching Govind (Nov 05)
- Re: Regarding pattern matching Paul Schmehl (Nov 05)
- Re: Regarding pattern matching Marc Norton (Nov 05)
- <Possible follow-ups>
- Regarding pattern Matching Govind (Nov 16)
- Re: Regarding pattern matching Paul Schmehl (Nov 05)