[Oisf-devel] Request new keyword http_uri_end for uri ending please ?

rmkml rmkml at yahoo.fr
Wed Jul 16 14:02:56 UTC 2014


Hi,

Thx you Community and OISF dev team for good works!

Maybe it's interesting adding new keyword like "http_uri_end" for checking uri content ending without pcre ?

like this:
... content:"/0/"; http_uri_end;

Similar exemple with classic "snort" like:
... content:"/0/"; http_uri; pcre:"/\/0\/$/U";

Because http_uri_end it's more performance than pcre ?
(but small used)

Regards
@Rmkml


More information about the Oisf-devel mailing list