Re: PCRE in snort

[lists () packetmail net]

On 06/30/16 08:37, Joel Esler (jesler) wrote:
> Yes.  Not recommended, but yes. 

I've done it in the past, but it's usually a fairly rare occurrence.  The PCRE
engine can be a performance drain so if you're doing this I would recommend
having strong content match "anchors" and potentially using the /R PCRE flag as
well.

Cheers,
Nathan

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!