Re: PCRE Parse Problem

[wkitty42 () windstream net]

On 08/08/2016 08:58 AM, Joel Esler (jesler) wrote:
> I believe this thread is open on the snort-sigs list.

it is and it has been responded to several times, too... i don't recall if the 
pcap attachment came thru over there or not, though...

> > On Jul 30, 2016, at 1:28 AM, Andrey Silversburg <andrey.silversburg () gmail com
> > <mailto:andrey.silversburg () gmail com>> wrote:
> >
> > Greetings, Snort Users
> >
> > My name is Andrey. I want to detect some content from HTTP form using this
> > rule in snort, but it seems snort cannot detect it. This is my rule
> >
> > *alert tcp any any -> $HOME_NET 80 (msg:"Web Attack !"; sid:100000008;
> > flow:to_server,established; content:"POST"; http_method; pcre:"/mouse/Usmix";
> > http_client_body; rev:1;)**
> > *
> > And this is my pcap



-- 
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity 
planning reports. http://sdm.link/zohodev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!