[Bro] Signature Matching Performance

[Chris]

On 04.05.2012, at 09:27, Seth Hall <seth at icir.org> wrote:

> On May 4, 2012, at 3:21 AM, Chris wrote:
> 
>> Hence, it might happen that e.g. a signature for a http request type might end up as /.*GET\ / although that obviously isn't what one would usually go for.
> 
> Are you trying to auto convert snort signatures?

No, I'm just trying to generate some signatures on my own. With a lot of leading .* hehe
Well I guess I have to rethink the idea a bit ;)

Thanks, Chris.