[Bro] Question on snort2bro

Robin Sommer robin at icir.org
Mon Apr 16 13:33:32 PDT 2007

On Mon, Apr 16, 2007 at 15:22 -0400, Mengjun Xie wrote:

> anyone tell me the reason? I guess the complexity of dealing with
> non-regular-expression features such as backreference in PCRE could be one
> of the reasons. But I want to get a confirmed answer.

Yes, right, or more generally it's the problem of translating
between the regexp syntax of system A and the syntax of system B.
Actually some time ago I started to write a tool which would convert
between a set of different regexp dialects (as far as possible) but
that never reached a mature state. 


Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list