[Snort-sigs] pcre usage for inline

Joel Esler eslerj at ...2420...
Wed Jun 15 13:25:58 EDT 2005


Just wondering, since we have the ability to modify items with regular
expressions...  can it be done in a snort rule?  like..

pcre:"s/stuff/newstuff/";

just a thought..  be able to modify actual data on the fly...

J




More information about the Snort-sigs mailing list