best way to match on CIFS filenames?

[Jason Haar <Jason.Haar () trimble co nz>]

I'm trying to write a rule to capture uploads of certain filenames via 
CIFS. However, over the years SMB became CIFS, Unicode was introduced, 
etc, etc. Which leads to the current mess whereby my "rule" is turning 
into "rules" as I try to figure out all the combinations.

Anyway, I was wondering if there was any built-in 'normalizing'  
function I could use so that I could look for strings without worrying 
about their case or unicode status.

e.g. a filename of "ntldr.exe" can be "NTLDR.EXE", "Ntldr.exE" as well 
as "n|00|T|00|l|00|D|00|r|00|.|00|e|00|x|00|e".

I am making so many fat-finger mistakes getting that right that I'm 
hoping the Sourcefire guys have too ;-)

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users