[Snort-devel] Possible error in snort-2.4 rule set

Erik de Castro Lopo erikd+snort at ...2292...
Tue Aug 2 17:31:44 EDT 2005


HI all,

I found this PCRE expression in Snort rule with sid 3545:

     pcre:"fn=Eye\d{4}_\d{2}.log/Rmsi";

Is that a valid PCRE? Where is the '/' at the start?

Erik
-- 
-------------------------------------------------------
[N] Erik de Castro Lopo, Senior Computer Engineer
[E] erik.de.castro.lopo at ...2292...
[W] http://www.sensorynetworks.com
[T] +61 2 83022726
[F] +61 2 94750316
[A] L6/140 William St, East Sydney NSW 2011, Australia
-------------------------------------------------------
"Premature optimization is the root of all evil" - C.A.R.Hoare
"If it doesn't work, don't optimize." - Christian Bau




More information about the Snort-devel mailing list