[Snort-sigs] False positive in 1777.6 (FTP EXPLOIT STAT * dos attempt)

nnposter nnposter at ...592...
Thu Dec 9 14:19:01 EST 2004


From: Brian <bmc at ...95...>
> On Thu, Dec 09, 2004 at 02:22:43PM -0700, nnposter wrote:
> > ...with a regular expression to ensure that the whole pattern is
> > a single line, resembling a FTP command:
> > 
> > pcre:"/^\s*STAT[ \t]+[^\n]*?\*/mi";
> 
> So, what is the ? for?

Is greediness deterministically or statistically faster here?

Cheers,
nnposter




More information about the Snort-sigs mailing list