Re: How to wite snort rule with "OR" condition without PCRE

[Alex Kirk <akirk () sourcefire com>]

It's not possible to do that; logic of that nature is part of why we have
the PCRE engine. A lot of people seem to think PCRE should never be used,
and generally cite performance concerns. The reality of it is, if used
wisely, PCRE is a very useful tool, and should be taken advantage of
wherever appropriate. Yes, there can be performance issues - but it can
also be very fast, too.
On Jul 8, 2012 10:26 AM, "Tran M. Thang" <tmthang () vncert vn> wrote:

> Hi everyone!
>
> Any one, please tell me how to write a Snort rule with OR condition
> without PCRE? For example: write a snort rule that matches web POST method
> and content contains "--" or "#".
>
> Thanks
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!