[Snort-sigs] Issue with pcre

Joel Esler (jesler) jesler at ...3865...
Mon Oct 6 17:27:38 EDT 2014


“only” on a fast_pattern is case insensitive.  you don’t need the nocase.


> On Oct 6, 2014, at 5:13 PM, lists at ...3397... wrote:
> 
> On 10/06/2014 04:10 PM, Sean Cavanaugh wrote:
>> Thank you Nate, your suggested changes appear to have worked! Only thing it
>> complained about was using fast_pattern:only. I removed the "only" part and it
>> accepted the rule.
>> 
>> Thanks again for your help!
> 
> Very glad to help, if it didn't like fast_pattern:only (thought Snort had fixed
> that with FP:only and a PCRE?) be sure to toss the nocase; back on there so it's
> in line with the PCRE /i flag.
> 
> Glad to help, happy miscreant punching :)
> 
> Cheers,
> Nathan
> 
> ------------------------------------------------------------------------------
> Slashdot TV.  Videos for Nerds.  Stuff that Matters.
> http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
> 
> 
> Please visit http://blog.snort.org for the latest news about Snort!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4881 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20141006/39fd13cc/attachment.bin>


More information about the Snort-sigs mailing list