[Bro] Signature Matching Performance

Chris bro at wressnegger.info
Fri May 4 01:00:59 PDT 2012

On 04.05.2012, at 09:27, Seth Hall <seth at icir.org> wrote:

> On May 4, 2012, at 3:21 AM, Chris wrote:
>> Hence, it might happen that e.g. a signature for a http request type might end up as /.*GET\ / although that obviously isn't what one would usually go for.
> Are you trying to auto convert snort signatures?

No, I'm just trying to generate some signatures on my own. With a lot of leading .* hehe
Well I guess I have to rethink the idea a bit ;)

Thanks, Chris.

More information about the Bro mailing list