Re: [RFC] string matching ematch

["David S. Miller" <davem@xxxxxxxxxxxxx>]

On Wed, 26 Jan 2005 16:07:14 +0100
Thomas Graf <tgraf@xxxxxxx> wrote:

> I'd like to discuss the string matching ematch, I don't care about the
> algorithm used but rather whether to make it stateful, match over
> fragments, etc.

I think you'll need to make it stateful.

I assume this is meant to be used for things like catching references
to "Falun Gong" in SMTP sessions and stuff like that.  Not that I know
any entity interested in such applications :-)

Anyways, if the string goes across the TCP data portion of multiple
packets, statefulness becomes necessary to catch it.  Right?