[Snort-sigs] False positive in 1777.6 (FTP EXPLOIT STAT * dos attempt)
nnposter at ...592...
Thu Dec 9 14:19:01 EST 2004
From: Brian <bmc at ...95...>
> On Thu, Dec 09, 2004 at 02:22:43PM -0700, nnposter wrote:
> > ...with a regular expression to ensure that the whole pattern is
> > a single line, resembling a FTP command:
> > pcre:"/^\s*STAT[ \t]+[^\n]*?\*/mi";
> So, what is the ? for?
Is greediness deterministically or statistically faster here?
More information about the Snort-sigs