Snort internals

Date: 01/01/02

Date: 1 Jan 2002 02:47:52 -0000
From: <>

('binary' encoding is not supported, stored as-is)

I thought that snort only used a two dimentional linked
list for the rule matching in the detection engine. I
read Marty's presentation at BlackHat and he states
that snort now uses a 3 dimentional linked list. Can
any one please explain this to me or point me to
some documentation on this. Thanks.