[Snort-sigs] Issue with pcre

lists at ...3397... lists at ...3397...
Mon Oct 6 17:13:15 EDT 2014

On 10/06/2014 04:10 PM, Sean Cavanaugh wrote:
> Thank you Nate, your suggested changes appear to have worked! Only thing it
> complained about was using fast_pattern:only. I removed the "only" part and it
> accepted the rule.
> Thanks again for your help!

Very glad to help, if it didn't like fast_pattern:only (thought Snort had fixed
that with FP:only and a PCRE?) be sure to toss the nocase; back on there so it's
in line with the PCRE /i flag.

Glad to help, happy miscreant punching :)


More information about the Snort-sigs mailing list