[Bro] Signature Matching Performance

Seth Hall seth at icir.org
Fri May 4 00:27:36 PDT 2012


On May 4, 2012, at 3:21 AM, Chris wrote:

> Hence, it might happen that e.g. a signature for a http request type might end up as /.*GET\ / although that obviously isn't what one would usually go for.

Are you trying to auto convert snort signatures?  

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/





More information about the Bro mailing list