Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: [Snort-sigs] Question about pcre syntax |
|---|---|
| Date: | Thu, 21 Feb 2008 18:44:57 -0500 |
I would hazard a guess that NO it is not going to be a significant performance difference in this specific case. Paul Schmehl wrote:
Is this correct syntax for pcre? Or will it not work at all? prce:"/foo|bar|some|such|thing/"; The intent is to provide a bunch of ors that would match after a previous positive content match. Would it be more efficient (less resource intensive) to write a separate rule for each match, even though the entire rule would be the same except for the second content match? Paul Schmehl (pauls@utdallas.edu) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/ ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-sigs mailing list Snort-sigs@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-sigs
------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-sigs mailing list Snort-sigs@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-sigs
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | [Snort-sigs] Emerging Threats Daily Signature Changes, emerging |
|---|---|
| Next by Date: | [Snort-sigs] Emerging Threats Daily Signature Changes, emerging |
| Previous by Thread: | Re: [Snort-sigs] Question about pcre syntax, Joel Esler |
| Next by Thread: | [Snort-sigs] Emerging Threats Weekly Signature Changes, emerging |
| Indexes: | [Date] [Thread] [Top] [All Lists] |