Re: Team0x42 Snort rules

["Randal T. Rioux" <randy () procyonlabs com>]

On Mon, April 7, 2008 6:00 pm, Brian Caswell wrote:
> On Apr 7, 2008, at 5:01 PM, TheWell wrote:
> > Some good snort rules by Team0x42
>
> Team B,
>
> Really?
>
> I see 5 rules that are all basically the same thing.  Perhaps you
> should update your regular expression to include all 5 cases you
> attempt to cover in 1 rule.
>
> The following regular expression is released under the license to ill,
> however you may not use it unless you are in Brooklyn, and you did not
> sleep while traveling to said city.
>
> (\%(60|3b|7c|00)|<)

You owe me a new keyboard, Brian.

Randy



-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Register now and save $200. Hurry, offer ends at 11:59 p.m., 
Monday, April 7! Use priority code J8TLD2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users