[Snort-sigs] pcre fails when using ; or (

Joseph Gama josephgama at ...144...
Wed Jul 28 02:32:08 EDT 2004


Hello,

The following should fire for ;a but it doesn't:
pcre:"/\;a/i";

same problem with (
pcre:"/function\(/i";
will fail for function(

However " doesn't need to be escaped.

[\;]a and \x3B fail as well. Does anyone have any
suggestions?

Thank you!

Peace,

Joseph Gama


	
		
__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail 




More information about the Snort-sigs mailing list