Re: Issue with pcre

["Joel Esler (jesler)" <jesler () cisco com>]

“only” on a fast_pattern is case insensitive.  you don’t need the nocase.


> On Oct 6, 2014, at 5:13 PM, lists () packetmail net wrote:
>
> On 10/06/2014 04:10 PM, Sean Cavanaugh wrote:
> > Thank you Nate, your suggested changes appear to have worked! Only thing it
> > complained about was using fast_pattern:only. I removed the "only" part and it
> > accepted the rule.
> >
> > Thanks again for your help!
>
> Very glad to help, if it didn't like fast_pattern:only (thought Snort had fixed
> that with FP:only and a PCRE?) be sure to toss the nocase; back on there so it's
> in line with the PCRE /i flag.
>
> Glad to help, happy miscreant punching :)
>
> Cheers,
> Nathan
>
> ------------------------------------------------------------------------------
> Slashdot TV.  Videos for Nerds.  Stuff that Matters.
> http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
>
>
> Please visit http://blog.snort.org for the latest news about Snort!

Attachment: smime.p7s
Description:

------------------------------------------------------------------------------
Slashdot TV.  Videos for Nerds.  Stuff that Matters.
http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!