Re: About Sort Pattern Matching

"Russ Combs \(rucombs\) via Snort-devel" <[email protected]> Mon, 16 Sep 2019 14:44:53 +0000
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <[email protected]>
--===============8082224166212304394==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_679FDD140D6F454AB299DCC3360AA3D0ciscocom_"

--_000_679FDD140D6F454AB299DCC3360AA3D0ciscocom_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

RGlkIHlvdSBjb25maWd1cmUgcHJvZmlsaW5nPyAgWW91IHdhbnQgdG8gbG9vayBhdCBtcHNlIGZv
ciBmYXN0IHBhdHRlcm4gc2VhcmNoaW5nIGFuZC9vciBjb250ZW50IGZvciBydWxlIG9wdGlvbiBl
dmFsLg0KDQpBcmUgeW91IGFza2luZyBhYm91dCBTbm9ydCAyIG9yIFNub3J0IDM/ICBDb250ZW50
IG9wdGlvbiBtYXRjaGluZyBpcyBkb25lIHZpYSBNUFNFIHNlYXJjaGVzIGlmIGZhc3QgcGF0dGVy
biBvbmx5LCBvciB2aWEgdGhlIGNvbnRlbnQgb3B0aW9uIGl0c2VsZiBvdGhlcndpc2UuICBTbyB3
aGF0IHBhcnQgYXJlIHlvdSBpbnRlcmVzdGVkIGluPw0KDQpNb3JlIGRldGFpbHMgZ2V0cyBtb3Jl
IGluZm8uDQoNClJ1c3MNCg0KRnJvbTogU25vcnQtZGV2ZWwgPHNub3J0LWRldmVsLWJvdW5jZXNA
bGlzdHMuc25vcnQub3JnPiBvbiBiZWhhbGYgb2YgTcO7xKfEhcmxybHJkMmWIFnEg8Wf0ZfRkyB2
aWEgU25vcnQtZGV2ZWwgPFNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZz4NClJlcGx5LVRvOiBN
w7vEp8SFybHJscmQyZYgWcSDxZ/Rl9GTIDx5ZXNpaS5nb21hbGlhbkBnbWFpbC5jb20+DQpEYXRl
OiBGcmlkYXksIFNlcHRlbWJlciAxMywgMjAxOSBhdCAzOjE4IEFNDQpUbzogIlNub3J0LWRldmVs
QGxpc3RzLnNub3J0Lm9yZyIgPFNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZz4NClN1YmplY3Q6
IFtTbm9ydC1kZXZlbF0gQWJvdXQgU29ydCBQYXR0ZXJuIE1hdGNoaW5nDQoNCkRlYXIgQWxsLA0K
Q2FuIHlvdSBndXlzIHRlbGwgbWUgd2hlcmUgZXhhY3RseSBbZnVuY3Rpb24gaW4gd2hpY2ggZmls
ZV0gZG9lcyBzbm9ydCBwZXJmb3JtcyAiY29udGVudCIgb3B0aW9uIG1hdGNoIG9mIGEgcnVsZSB3
aXRoIGlucHV0IHBhY2tldCBkYXRhPyBJIGhhdmUgZGlzYWJsZWQgYWxsIHRoZSBydWxlcyBidXQg
b25lIGluIGxvY2FsLnJ1bGVzIHdoaWNoIGhhcyAiY29udGVudDpCYWhyaWEiIHJ1bGUgb3B0aW9u
IGFuZCB3YW50IHRvIGNhbGN1bGF0ZSB0aW1lIGZvciB0aGF0IHNpbmdsZSBtYXRjaCBhZ2FpbnN0
IHZhcnlpbmcgbGVuZ3RoIHBhY2tldHMuDQoNCi0tDQpSZWdhcmRzLA0KTXVoYW1tYWQgWWFzaXIN
Cg==

--_000_679FDD140D6F454AB299DCC3360AA3D0ciscocom_
Content-Type: text/html; charset="utf-8"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64

PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4
bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo
dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo
dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp
dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l
dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg
bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj
ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2
IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy
IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJjb21pYyBz
YW5zIG1zIjsNCglwYW5vc2UtMTozIDE1IDcgMiAzIDMgMiAyIDIgNDt9DQovKiBTdHlsZSBEZWZp
bml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXtt
YXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0K
CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl
cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1k
ZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93
ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNv
cmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u
b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6
YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K
CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxp
YnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBl
cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9y
OndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9u
bHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVp
biAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2Vj
dGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5
IGxhbmc9IkVOLVVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNz
PSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RGlkIHlvdSBjb25maWd1cmUg
cHJvZmlsaW5nPyZuYnNwOyBZb3Ugd2FudCB0byBsb29rIGF0IG1wc2UgZm9yIGZhc3QgcGF0dGVy
biBzZWFyY2hpbmcgYW5kL29yIGNvbnRlbnQgZm9yIHJ1bGUgb3B0aW9uIGV2YWwuPG86cD48L286
cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs
YXNzPSJNc29Ob3JtYWwiPkFyZSB5b3UgYXNraW5nIGFib3V0IFNub3J0IDIgb3IgU25vcnQgMz8m
bmJzcDsgQ29udGVudCBvcHRpb24gbWF0Y2hpbmcgaXMgZG9uZSB2aWEgTVBTRSBzZWFyY2hlcyBp
ZiBmYXN0IHBhdHRlcm4gb25seSwgb3IgdmlhIHRoZSBjb250ZW50IG9wdGlvbiBpdHNlbGYgb3Ro
ZXJ3aXNlLiZuYnNwOyBTbyB3aGF0IHBhcnQgYXJlIHlvdSBpbnRlcmVzdGVkIGluPzxvOnA+PC9v
OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj
bGFzcz0iTXNvTm9ybWFsIj5Nb3JlIGRldGFpbHMgZ2V0cyBtb3JlIGluZm8uPG86cD48L286cD48
L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz
PSJNc29Ob3JtYWwiPlJ1c3M8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv
OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpz
b2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9
Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2si
PkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6Ymxh
Y2siPlNub3J0LWRldmVsICZsdDtzbm9ydC1kZXZlbC1ib3VuY2VzQGxpc3RzLnNub3J0Lm9yZyZn
dDsgb24gYmVoYWxmIG9mIE3Du8SnxIXJscmxyZDJliBZxIPFn9GX0ZMgdmlhIFNub3J0LWRldmVs
ICZsdDtTbm9ydC1kZXZlbEBsaXN0cy5zbm9ydC5vcmcmZ3Q7PGJyPg0KPGI+UmVwbHktVG86IDwv
Yj5Nw7vEp8SFybHJscmQyZYgWcSDxZ/Rl9GTICZsdDt5ZXNpaS5nb21hbGlhbkBnbWFpbC5jb20m
Z3Q7PGJyPg0KPGI+RGF0ZTogPC9iPkZyaWRheSwgU2VwdGVtYmVyIDEzLCAyMDE5IGF0IDM6MTgg
QU08YnI+DQo8Yj5UbzogPC9iPiZxdW90O1Nub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZyZxdW90
OyAmbHQ7U25vcnQtZGV2ZWxAbGlzdHMuc25vcnQub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwv
Yj5bU25vcnQtZGV2ZWxdIEFib3V0IFNvcnQgUGF0dGVybiBNYXRjaGluZzxvOnA+PC9vOnA+PC9z
cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7
PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RGVhciBBbGws
PGJyPg0KQ2FuIHlvdSBndXlzIHRlbGwgbWUgd2hlcmUgZXhhY3RseSBbZnVuY3Rpb24gaW4gd2hp
Y2ggZmlsZV0gZG9lcyBzbm9ydCBwZXJmb3JtcyAmcXVvdDtjb250ZW50JnF1b3Q7IG9wdGlvbiBt
YXRjaCBvZiBhIHJ1bGUgd2l0aCBpbnB1dCBwYWNrZXQgZGF0YT8gSSBoYXZlIGRpc2FibGVkIGFs
bCB0aGUgcnVsZXMgYnV0IG9uZSBpbiBsb2NhbC5ydWxlcyB3aGljaCBoYXMgJnF1b3Q7Y29udGVu
dDpCYWhyaWEmcXVvdDsgcnVsZSBvcHRpb24gYW5kIHdhbnQgdG8gY2FsY3VsYXRlIHRpbWUgZm9y
DQogdGhhdCBzaW5nbGUgbWF0Y2ggYWdhaW5zdCB2YXJ5aW5nIGxlbmd0aCBwYWNrZXRzLjxiciBj
bGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi
PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8
bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJk
cywmbmJzcDs8YnI+DQo8Yj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Y29taWMgc2Fu
cyBtcyZxdW90Oztjb2xvcjojNDQ0NDQ0Ij5NdWhhbW1hZCBZYXNpcjwvc3Bhbj48L2I+PG86cD48
L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRt
bD4NCg==

--_000_679FDD140D6F454AB299DCC3360AA3D0ciscocom_--

--===============8082224166212304394==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

--===============8082224166212304394==--