[Oisf-devel] Request new keyword http_uri_end for uri ending please ?
rmkml
rmkml at yahoo.fr
Wed Jul 16 14:02:56 UTC 2014
Hi,
Thx you Community and OISF dev team for good works!
Maybe it's interesting adding new keyword like "http_uri_end" for checking uri content ending without pcre ?
like this:
... content:"/0/"; http_uri_end;
Similar exemple with classic "snort" like:
... content:"/0/"; http_uri; pcre:"/\/0\/$/U";
Because http_uri_end it's more performance than pcre ?
(but small used)
Regards
@Rmkml
More information about the Oisf-devel
mailing list