Re: Question on fast_pattern

[Todd Wease <twease () sourcefire com>]

All uri/http buffer contents will be added to the fast pattern matcher. 
  For each port group, there are potentially two fast pattern matchers - 
one for http contents and one for regular contents.  Because more than 
one http buffer can be used as the input string to the fast pattern 
matcher, all http contents are added to that fast pattern matcher, 
instead of having a fast pattern matcher for each http content.

On 10/12/2009 10:38 AM, Anoop Saldanha wrote:
> Hi,
>
> I wanted to know if fast_pattern can be used as a modifier along with
> uricontent.  Thanks for taking time to read this.  Please redirect me if
> I posted this question in the wrong list.
>
> --
> Thanks,
> Anoop Saldanha
>
>
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
>
>
>
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs