Snort mailing list archives
Re: What does /R mean in pcre?
From: Dorian ROSSE via Snort-users <snort-users () lists snort org>
Date: Sun, 1 Sep 2019 14:14:37 +0000
« R = Search from the end of the previous match and on » Provenance : Courrier<https://go.microsoft.com/fwlink/?LinkId=550986> pour Windows 10 ________________________________ De : Dorian ROSSE Envoyé : Sunday, September 1, 2019 4:13:18 PM À : fluency0726 <fluency0726 () gmail com>; snort-users () lists snort org <snort-users () lists snort org> Objet : RE: [Snort-users] What does /R mean in pcre? Since It followings ebook It explains for why R modifier is used : https://books.google.fr/books?id=ZI1sfn4eJ8oC&pg=PA316&lpg=PA316&dq=does+/R+is+a+modifier+for+pcre+programming+to+snort+?&source=bl&ots=NgRj0qyBYi&sig=ACfU3U3apVd3rlgT24Bp4SRQ5rUBTur6Qg&hl=fr&sa=X&ved=2ahUKEwjv-Irw5a_kAhVCxoUKHYWCAdgQ6AEwAnoECAkQAQ#v=onepage&q=does%20%2FR%20is%20a%20modifier%20for%20pcre%20programming%20to%20snort%20%3F&f=false Regards. Dorian ROSSE. Provenance : Courrier<https://go.microsoft.com/fwlink/?LinkId=550986> pour Windows 10 ________________________________ De : Dorian ROSSE Envoyé : Sunday, September 1, 2019 4:11:32 PM À : fluency0726 <fluency0726 () gmail com>; snort-users () lists snort org <snort-users () lists snort org> Objet : RE: [Snort-users] What does /R mean in pcre? Since It followings ebook page https://books.google.fr/books?id=vA8o2tMl04kC&pg=PA197&lpg=PA197&dq=does+/R+is+a+modifier+for+pcre+programming+to+snort+?&source=bl&ots=5Tmuc3mHcy&sig=ACfU3U3EBj3YXgulNmMjZpzZt2jNCdOF4A&hl=fr&sa=X&ved=2ahUKEwjv-Irw5a_kAhVCxoUKHYWCAdgQ6AEwAXoECAgQAQ#v=onepage&q=does%20%2FR%20is%20a%20modifier%20for%20pcre%20programming%20to%20snort%20%3F&f=false R isn’t a modifier Provenance : Courrier<https://go.microsoft.com/fwlink/?LinkId=550986> pour Windows 10 ________________________________ De : fluency0726 <fluency0726 () gmail com> Envoyé : Sunday, September 1, 2019 3:51:14 PM À : dorianbrice () hotmail fr <dorianbrice () hotmail fr> Objet : Re: [Snort-users] What does /R mean in pcre? Thank you for your reply, but I don't think the character "R" in the expression "/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR" represents the R programming language, because it's in the regular expression string. Firstly I think it's a modifier like "s", however, I read the pcre doc and didn't find there's an "R" modifier. On 9/1/2019 20:45,Dorian ROSSE<dorianbrice () hotmail fr><mailto:dorianbrice () hotmail fr> wrote: https://en.m.wikipedia.org/wiki/R_(programming_language) Télécharger Outlook pour Android<https://aka.ms/ghei36> ________________________________ From: Snort-users <snort-users-bounces () lists snort org> on behalf of fluency0726 via Snort-users <snort-users () lists snort org> Sent: Sunday, September 1, 2019 2:21:28 PM To: snort-users () lists snort org <snort-users () lists snort org> Subject: [Snort-users] What does /R mean in pcre? Hi all, I'm trying to generate some traces that can trigger snort's alert to do some performance test. But when I read some rules with pcre option, I met some regular expressions that I didn't understand. Like the screenshot I attached shows, the regular expression contains sR after the string boundary character "/", I know that "s" is a modifier that set PCRE_DOTALL, however, I don't know what does "R" mean here. I checked pcre docs and didn't find there's an "R" modifier. So what does "R" mean here, is it a modifier or something else? I'm very confused about it. I would be very grateful if you can help me! Thx! [cid:43F6D154-9A8D-4534-B08A-19B49B98828B@mailmaster] Chang Liu
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- What does /R mean in pcre? fluency0726 via Snort-users (Sep 01)
- Message not available
- Message not available
- Re: What does /R mean in pcre? Dorian ROSSE via Snort-users (Sep 01)
- Re: What does /R mean in pcre? Dorian ROSSE via Snort-users (Sep 01)
- Re: What does /R mean in pcre? Dorian ROSSE via Snort-users (Sep 01)
- Message not available
- Message not available
- Re: What does /R mean in pcre? wkitty42--- via Snort-users (Sep 01)
- Re: What does /R mean in pcre? Joel Esler (jesler) via Snort-users (Sep 01)
- Re: What does /R mean in pcre? fluency0726 via Snort-users (Sep 01)