Main Archive Page > Month Archives  > snort-devel archives

[Snort-devel] snort single pattern matching algorithm

From: Beliz Senyuz <beliz.senyuz_at_nospam>
Date: Tue Apr 29 2008 - 02:22:17 GMT
To: snort-devel@lists.sourceforge.net

Hi,

I am working on pattern matching algorithms. I want to find the occurrence of a single pattern in a given text.

I found the Boyer-Moore Algorithm implementation in (src/mstring.c) Is this code valid? Or even for single pattern search do I have to use Aho-Corasick?

Here is my question about Boyer-Moore implementation:
- search function mSearch which is in (src/mstring.c) is called from
(detection_plugins/sp_pattern_match.c)
- mSearch takes as parameter Boyer-Moore skip and shift tables

• skip and shift tables are computed by make_precomp function in (detection_plugins/sp_pattern_match.c)
• make_precomp is called AFTER mSearch

How does it work? How the parameters can be computed after the function call?

Thanks,

Beliz

---

This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel