Re: Team0x42 Snort rules

[Brian Caswell <bmc () snort org>]

On Apr 7, 2008, at 5:01 PM, TheWell wrote:
> Some good snort rules by Team0x42

Team B,

Really?

I see 5 rules that are all basically the same thing.  Perhaps you  
should update your regular expression to include all 5 cases you  
attempt to cover in 1 rule.

The following regular expression is released under the license to ill,  
however you may not use it unless you are in Brooklyn, and you did not  
sleep while traveling to said city.

(\%(60|3b|7c|00)|<)

Brian

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Register now and save $200. Hurry, offer ends at 11:59 p.m., 
Monday, April 7! Use priority code J8TLD2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users