[Snort-sigs] False positive in 1777.6 (FTP EXPLOIT STAT * dos attempt)

Brian bmc at ...95...
Thu Dec 9 13:47:07 EST 2004


On Thu, Dec 09, 2004 at 02:22:43PM -0700, nnposter wrote:
> ...with a regular expression to ensure that the whole pattern is
> a single line, resembling a FTP command:
> 
> pcre:"/^\s*STAT[ \t]+[^\n]*?\*/mi";

So, what is the ? for?

Brian




More information about the Snort-sigs mailing list