Snort mailing list archives
Re: Matching PCRE
From: Matt Olney <molney () sourcefire com>
Date: Tue, 19 Jan 2010 16:13:46 -0500
I think greediness may be biting you in the butt... So this would match: re> /(\w+).?=.?\1/ <----rough rewrite of your pcre data> applee=eapple 0: applee=eapple 1: apple data> sap=bsa 0: sap=bsa 1: sa data> buffalo=uffalo 0: uffalo=uffalo 1: uffalo data> buff=abuf 0: buff=abuf 1: buf ------------------------------------------------------------------------------ Throughout its 18-year history, RSA Conference consistently attracts the world's best and brightest in the field, creating opportunities for Conference attendees to learn about information security's most important issues through interactions with peers, luminaries and emerging and established companies. http://p.sf.net/sfu/rsaconf-dev2dev _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
Current thread:
- Matching PCRE Paul Schmehl (Jan 19)
- Re: Matching PCRE Guise McAllaster (Jan 19)
- Re: Matching PCRE Guise McAllaster (Jan 19)
- Re: Matching PCRE Matt Olney (Jan 19)
- Re: Matching PCRE Paul Schmehl (Jan 19)
- Re: Matching PCRE Paul Schmehl (Jan 19)
- Re: Matching PCRE Joel Esler (Jan 19)
- Re: Matching PCRE Matt Olney (Jan 19)
- Re: Matching PCRE Paul Schmehl (Jan 19)
- Re: Matching PCRE Guise McAllaster (Jan 19)
- Re: Matching PCRE Guise McAllaster (Jan 19)