PCRE Parse Problem

[Andrey Silversburg <andrey.silversburg () gmail com>]

Greetings, Snort Users

My name is Andrey. I want to detect some content from HTTP form using 
this rule in snort, but it seems snort cannot detect it. This is my rule

*alert tcp any any -> $HOME_NET 80 (msg:"Web Attack !"; sid:100000008; 
flow:to_server,established; content:"POST"; http_method; 
pcre:"/mouse/Usmix"; http_client_body; rev:1;)**
*
And this is my pcap

Attachment: pcre.pcap
Description:

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!