Snort internals

From: ndesai01@tampabay.rr.com
Date: 01/01/02


Date: 1 Jan 2002 02:47:52 -0000
From: <ndesai01@tampabay.rr.com>
To: focus-ids@securityfocus.com


('binary' encoding is not supported, stored as-is)

I thought that snort only used a two dimentional linked
list for the rule matching in the detection engine. I
read Marty's presentation at BlackHat and he states
that snort now uses a 3 dimentional linked list. Can
any one please explain this to me or point me to
some documentation on this. Thanks.

Neil