[Emerging-Sigs] 2 SIGS: ET SCAN Inspathx Path Disclosure Scanner

Joel Esler jesler at sourcefire.com
Fri Oct 1 13:02:30 EDT 2010

I just want to let you guys know that I am not ignoring this thread.  It's
piled into this 400+ email inbox I have right now, but no excuses.

I've been told, by several people within Sourcefire, developers and VRT
alike that nocase has little to no impact on performance.  The case
normalization takes place all within the fast pattern matcher upon Snort
start up.  So I don't think it has any direct impact on line speed

Unfortunately, the guy to ask about the fast pattern matcher is not in the
office right now, so I can't get you a more technical description, but I'll
try as soon as I can.


On Fri, Oct 1, 2010 at 12:55 PM, waldo kitty <wkitty42 at windstream.net>wrote:

> On 10/1/2010 12:37, evilghost at packetmail.net wrote:
> > Hash: SHA1
> >
> >> the definition of /"some"/ and the efficiency of the code used could
> very well
> >> be so negligible as to be essentially unmeasurable ;)
> >
> > Except when you have high volume sensors, a large number of signatures
> > with superfluous nocase content modifiers sprinkled on every signature,
> > and the size of the respective match.
> ummm...
> 1. i forgot to put quotes around "essentially unmeasurable"
> 2. i point to the "the definition of "some" line in my quote above
> 3. i was agreeing with you ;)
> 4. in the case of large amounts of comparisons, see #3
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> Support Emerging Threats! Get your ET Stuff! Tshirts, Coffee Mugs and
> Lanyards
> http://www.emergingthreats.net/index.php/support-et-and-buy-et-schwag.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20101001/0cbea487/attachment.html

More information about the Emerging-sigs mailing list