Pattern Match in Content

["Dan Fiorito" <danf () clearnetwork com>]

Does anyone know of a way to pattern match in the content option of a
rule. I have read the Regex option and think this is the way to do it. I
am trying to match a part number format of   XX-XXX-XXXX.

 Would this come at a high cost in terms of overhead? Does this example
make sense.

(flags: A+; content: "**-***-****"; regex; msg: "Internal Part Number";)

Thanks

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users