I have just read some source code, and found In snort, an implementation
of a Aho-Corasick like Boyer-Moore Style Searching Algorthim has given,
it allows multiple patterns to be searched for in a packet at the same
time.and the snort content rules are placed in a Aho-Corasick like keyword
search tree that overlaps similar prefixes.
Right - we're aiming for something along those lines, though a bit different.
Vern