Snort mailing list archives
Re: /smi at the end of pcre statements
From: Matt Olney <molney () sourcefire com>
Date: Mon, 16 Mar 2009 12:56:08 -0400
From some code I have stashed away for reference:
switch(*opts) { case 'i': compile_flags |= PCRE_CASELESS; break; case 's': compile_flags |= PCRE_DOTALL; break; case 'm': compile_flags |= PCRE_MULTILINE; break; case 'x': compile_flags |= PCRE_EXTENDED; break; /* * these are pcre specific... don't work with perl */ case 'A': compile_flags |= PCRE_ANCHORED; break; case 'E': compile_flags |= PCRE_DOLLAR_ENDONLY; break; case 'G': compile_flags |= PCRE_UNGREEDY; break; /* * these are snort specific don't work with pcre or perl */ case 'R': pcre_data->options |= SNORT_PCRE_RELATIVE; break; case 'U': pcre_data->options |= SNORT_PCRE_HTTP_URI; break; case 'B': pcre_data->options |= SNORT_PCRE_RAWBYTES; break; case 'P': pcre_data->options |= SNORT_PCRE_HTTP_BODY; break; case 'O': pcre_data->options |= SNORT_OVERRIDE_MATCH_LIMIT; break; case 'H': pcre_data->options |= SNORT_PCRE_HTTP_HEADER; break; case 'M': pcre_data->options |= SNORT_PCRE_HTTP_METHOD; break; case 'C': pcre_data->options |= SNORT_PCRE_HTTP_COOKIE; break; On Mon, Mar 16, 2009 at 12:32 PM, Stephen Mullins <steve.mullins.work () gmail com> wrote:
All, What does the /smi portion of a pcre statement signify? Any information anyone can provide would be appreciated. Thanks, Steve Mullins ------------------------------------------------------------------------------ Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are powering Web 2.0 with engaging, cross-platform capabilities. Quickly and easily build your RIAs with Flex Builder, the Eclipse(TM)based development software that enables intelligent coding and step-through debugging. Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are powering Web 2.0 with engaging, cross-platform capabilities. Quickly and easily build your RIAs with Flex Builder, the Eclipse(TM)based development software that enables intelligent coding and step-through debugging. Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- /smi at the end of pcre statements Stephen Mullins (Mar 16)
- Re: /smi at the end of pcre statements Matt Olney (Mar 16)
- Re: /smi at the end of pcre statements Stephen Mullins (Mar 16)
- Re: /smi at the end of pcre statements Nigel Houghton (Mar 16)
- Re: /smi at the end of pcre statements Stephen Mullins (Mar 16)
- Re: /smi at the end of pcre statements Matt Olney (Mar 16)