Subject: Re: [RFC] string matching ematch

From: "David S. Miller" <[email-masked]>
Date: Wed, 26 Jan 2005 13:03:23 -0800

On Wed, 26 Jan 2005 16:07:14 +0100
Thomas Graf <[email-masked]> wrote:

> I'd like to discuss the string matching ematch, I don't care about the
> algorithm used but rather whether to make it stateful, match over
> fragments, etc.

I think you'll need to make it stateful.

I assume this is meant to be used for things like catching references
to "Falun Gong" in SMTP sessions and stuff like that.  Not that I know
any entity interested in such applications :-)

Anyways, if the string goes across the TCP data portion of multiple
packets, statefulness becomes necessary to catch it.  Right?