Snort mailing list archives
Re: Signature question
From: Joel Esler <jesler () sourcefire com>
Date: Thu, 4 Feb 2010 10:01:26 -0500
No, you can use the "R" pcre modifier which makes the pcre 'relative' to the last content match. You can't use depth, offset, distance, or within with pcre. J On Thu, Feb 4, 2010 at 8:01 AM, spiffy pickle <spiffypickle () gmail com>wrote:
Hello everyone, I have a question using pcre with depth, offset, distance, and within qualifiers. I can't seem to find any documentation pointing one way or the other. Can you use those qualifiers with pcre? Does the pcre engine care about the where the content match pointer is pointing? Much thanks, SP ------------------------------------------------------------------------------ The Planet: dedicated and managed hosting, cloud storage, colocation Stay online with enterprise data centers and the best network in the business Choose flexible plans and management services without long-term contracts Personal 24x7 support from experience hosting pros just a phone call away. http://p.sf.net/sfu/theplanet-com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Joel Esler
------------------------------------------------------------------------------ The Planet: dedicated and managed hosting, cloud storage, colocation Stay online with enterprise data centers and the best network in the business Choose flexible plans and management services without long-term contracts Personal 24x7 support from experience hosting pros just a phone call away. http://p.sf.net/sfu/theplanet-com
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Signature question spiffy pickle (Feb 04)
- Re: Signature question Joel Esler (Feb 04)
- Re: Signature question Matt Olney (Feb 04)
- Re: Signature question Joel Esler (Feb 04)