[Snort-devel] Possible error in snort-2.4 rule set

Joel Esler eslerj at ...2499...
Wed Aug 3 05:47:57 EDT 2005


Whoops...

On 8/2/05, Erik de Castro Lopo <erikd+snort at ...2292...> wrote:
> 
> HI all,
> 
> I found this PCRE expression in Snort rule with sid 3545:
> 
> pcre:"fn=Eye\d{4}_\d{2}.log/Rmsi";
> 
> Is that a valid PCRE? Where is the '/' at the start?
> 
> Erik
> --
> -------------------------------------------------------
> [N] Erik de Castro Lopo, Senior Computer Engineer
> [E] erik.de.castro.lopo at ...2292...
> [W] http://www.sensorynetworks.com
> [T] +61 2 83022726
> [F] +61 2 94750316
> [A] L6/140 William St, East Sydney NSW 2011, Australia
> -------------------------------------------------------
> "Premature optimization is the root of all evil" - C.A.R.Hoare
> "If it doesn't work, don't optimize." - Christian Bau
> 
> 
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20050803/fc237970/attachment.html>


More information about the Snort-devel mailing list