Regex pattern matching with large payloads for TCP port

[h.panahi]

Hello, I'm new to Snort and have a question about pattern matching and memory handling. I want to set a rule for TCP traffic on port 4050 to drop packets that contain the pattern "ABC*XYZ". My concern is that the content between "ABC" and "XYZ" could be large, even up to 1GB or more. How does Snort handle such a pattern?

If Snort detects "ABC" but doesn’t find "XYZ" right away, does it buffer all incoming packets on this port until "XYZ" appears to decide whether to drop the session? And overall, is this kind of regex pattern practical and efficient for real-time network monitoring?