Snort internalsFrom: email@example.com
- Next in thread: Martin Roesch: "Re: Snort internals"
- Reply: Martin Roesch: "Re: Snort internals"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 1 Jan 2002 02:47:52 -0000 From: <firstname.lastname@example.org> To: email@example.com('binary' encoding is not supported, stored as-is)
I thought that snort only used a two dimentional linked
list for the rule matching in the detection engine. I
read Marty's presentation at BlackHat and he states
that snort now uses a 3 dimentional linked list. Can
any one please explain this to me or point me to
some documentation on this. Thanks.