Greetings all,
I am a newbie to snort and to this forum so apologies in advance if this
strikes as a basic question.
I am currently studying the caching behaviour of the snort pattern
matcher as part of my thesis, in particular iam studying the caching
behaviour of the Aho-Corasick search Automaton. In the snort code i can
see that in case of a partial match, say case when there are multiple
"contents" the entire rules that partially match the given content are
printed out. But for commonly occuring patterns , like "|00|", there are
about 5000 partial matches. Does the snort system traverse the entire
linked list. Is there a need to traverse through this entire list or a
"union" of the different sub-pattern matches would suffice?. This is of
interest to me as it does impact the caching behaviour of the system.
Further, I also notice that some pcre rules contain "content" in
addition to the same content in the pcre regexp.
For example the following rule from backdoor.rules contains "NetBus" in
Content and in the pcre as well.
alert tcp $HOME_NET 1024: -> $EXTERNAL_NET any (msg:"BACKDOOR netbus
active"; flow:from_server,established; content:"NetBus"; depth:6;
nocase; pcre:"/^NetBus\s+\d+\x2E\d+/smi";
reference:url,www.2-spyware.com/file-backdoor-netbus-12-exe.html;
classtype:trojan-activity; sid:109; rev:6;)
So does this mean that both the regexp pattern matching and Aho Corasick
matching would be done with these rules.
Thanking you in Advance
Regards
Govind
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
