Snort mailing list archives

Re: Signature question


From: Joel Esler <jesler () sourcefire com>
Date: Thu, 4 Feb 2010 10:01:26 -0500

No, you can use the "R" pcre modifier which makes the pcre 'relative' to the
last content match.  You can't use depth, offset, distance, or within with
pcre.

J

On Thu, Feb 4, 2010 at 8:01 AM, spiffy pickle <spiffypickle () gmail com>wrote:

Hello everyone,
  I have a question using pcre with depth, offset, distance, and within
qualifiers. I can't seem to find any documentation pointing one way or the
other. Can you use those qualifiers with pcre? Does the pcre engine care
about the where the content match pointer is pointing?

Much thanks,
   SP


------------------------------------------------------------------------------
The Planet: dedicated and managed hosting, cloud storage, colocation
Stay online with enterprise data centers and the best network in the
business
Choose flexible plans and management services without long-term contracts
Personal 24x7 support from experience hosting pros just a phone call away.
http://p.sf.net/sfu/theplanet-com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




-- 
Joel Esler
------------------------------------------------------------------------------
The Planet: dedicated and managed hosting, cloud storage, colocation
Stay online with enterprise data centers and the best network in the business
Choose flexible plans and management services without long-term contracts
Personal 24x7 support from experience hosting pros just a phone call away.
http://p.sf.net/sfu/theplanet-com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: