[Emerging-Sigs] Daily Ruleset Update Summary 09/092014

waldo kitty wkitty42 at windstream.net
Thu Sep 11 09:13:59 EDT 2014


On 9/10/2014 11:20 PM, Darien Huss wrote:
> The URI contents are split up so the first match fits into the 20-byte default
> size of the fast pattern matcher. The "/maxpower-static/" always occurs at
> depth:17, but since we are not checking depth (fast_pattern:only), we have
> applied an offset of 17 so the content matcher doesn't waste time looking in the
> first 17 bytes where "templates/" cannot occur.

thanks darien! when explained like that, it seems to make perfect sense...

-- 
  NOTE: No off-list assistance is given without prior approval.
        Please *keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.


More information about the Emerging-sigs mailing list