Snort mailing list archives
Re: Issue with pcre
From: lists () packetmail net
Date: Mon, 06 Oct 2014 18:35:36 -0500
On 10/06/2014 06:29 PM, waldo kitty wrote:
something else to consider is if you really need a pcre with that rule... the content match looks pretty definite... speaking of that, your pcre, both, do not include the trailing '/'...
Yeah they do, PCRE from my reply minus the /U URI buffer Snort-centric PCRE modifier: PCRE version 8.12 2011-01-15 re> /\/trackback\/$/i data> http://example.com/trackbackmeowmeow No match data> http://example.com/trackback No match data> http://example.com/trackback/ 0: /trackback/ data> ^C Cheers, Nathan ------------------------------------------------------------------------------ Slashdot TV. Videos for Nerds. Stuff that Matters. http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Issue with pcre Sean Cavanaugh (Oct 06)
- Re: Issue with pcre lists (Oct 06)
- Re: Issue with pcre Sean Cavanaugh (Oct 06)
- Re: Issue with pcre lists (Oct 06)
- Re: Issue with pcre Joel Esler (jesler) (Oct 06)
- Re: Issue with pcre lists (Oct 06)
- Re: Issue with pcre Joel Esler (jesler) (Oct 06)
- Re: Issue with pcre lists (Oct 06)
- Re: Issue with pcre Sean Cavanaugh (Oct 06)
- Re: Issue with pcre lists (Oct 06)
- Re: Issue with pcre waldo kitty (Oct 06)
- Re: Issue with pcre lists (Oct 06)
- Re: Issue with pcre waldo kitty (Oct 06)
- Re: Issue with pcre lists (Oct 06)