Re: PCRE Parse Problem

["Joel Esler (jesler)" <jesler () cisco com>]

I believe this thread is open on the snort-sigs list.



> On Jul 30, 2016, at 1:28 AM, Andrey Silversburg <andrey.silversburg () gmail com> wrote:
>
> Greetings, Snort Users
>
> My name is Andrey. I want to detect some content from HTTP form using this rule in snort, but it seems snort cannot 
> detect it. This is my rule
>
> alert tcp any any -> $HOME_NET 80 (msg:"Web Attack !"; sid:100000008; flow:to_server,established; content:"POST"; 
> http_method; pcre:"/mouse/Usmix"; http_client_body; rev:1;)
>
> And this is my pcap
>
> <pcre.pcap>------------------------------------------------------------------------------
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!