Re: Regarding pattern matching

[Marc Norton <mnorton () sourcefire com>]

Its actually backwards from what is printed below, sounds like you meant it the other way.  Anyways,
Aho is run 1st against the traffic to find all rules that have a matching content, than for each of
these the full rule is evaluated, including the pcre content.

Paul Schmehl wrote:
> --On Monday, November 05, 2007 18:30:23 +0100 Govind <govind () ac upc edu> 
> wrote:
>
> > Greetings all,
> >
> > I am a newbie to snort and to this forum so apologies in advance if this
> > strikes as a basic question.
> > I am currently studying the caching behaviour of the snort pattern
> > matcher as part of my thesis, in particular iam studying the caching
> > behaviour of the Aho-Corasick search Automaton. In the snort code i can
> > see that in case of a partial match, say case when there are multiple
> > "contents" the entire rules that partially match the given content are
> > printed out. But for commonly occuring patterns , like "|00|", there are
> > about 5000 partial matches. Does the snort system traverse the entire
> > linked list.  Is there a need to traverse through this entire list or a
> > "union" of the different sub-pattern matches would suffice?.  This is of
> > interest to me as it does impact the caching behaviour of the system.
> >
> > Further, I also notice that some pcre rules contain "content" in
> > addition to the same content in the pcre regexp.
> > For example the following rule from backdoor.rules contains "NetBus" in
> > Content and in the pcre as well.
> >
> > alert tcp $HOME_NET 1024: -> $EXTERNAL_NET any (msg:"BACKDOOR netbus
> > active"; flow:from_server,established; content:"NetBus"; depth:6;
> > nocase; pcre:"/^NetBus\s+\d+\x2E\d+/smi";
> > reference:url,www.2-spyware.com/file-backdoor-netbus-12-exe.html;
> > classtype:trojan-activity; sid:109; rev:6;)
> >
> > So does this mean that both the regexp pattern matching and Aho Corasick
> > matching would be done with these rules.
> No, what it means is that, unless the regex rule matches, the Aho Corasick 
> matching will never be done.  Since the latter is more "expensive", you 
> only want to do it when you have a potential match, as confirmed by the 
> former having affirmatively matched content in the packet.


-- 
Marc Norton
Sourcefire,Inc   410-423-1924
www.snort.org    www.sourcefire.com

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users