On Wed, Apr 02, 2008 at 12:17:22AM +0000, Sylvain Le Gall wrote:
> I have two questions:
> * do you think you can get something efficient (part of the paper you
>  are linking, talked about performance)

There's lots of room for optimization in the current code.  It mainly
aims to be working.

> * is there a way to retain part of the data structure... E.g TCP/UDP
>  packet has the same IP part (the one you describe) + a TCP/UDP
>  header...

At the moment you cannot define and reuse patterns, but it's certainly
something which could be added (as in micmatch).

However it is easy to modify the examples so they match over TCP and
UDP packets, either by adding a second whole case to the top level
bitmatch, or by adding a sub-bitmatch matching the payload.

Rich.

-- 
Richard Jones
Red Hat