[Snort-sigs] Issue with pcre

Joel Esler (jesler) jesler at ...3865...
Mon Oct 6 17:40:58 EDT 2014


> On Oct 6, 2014, at 5:31 PM, lists at ...3397... wrote:
> 
> On 10/06/2014 04:27 PM, Joel Esler (jesler) wrote:
>> “only” on a fast_pattern is case insensitive.  you don’t need the nocase.
> 
> He had to remove the 'only', Snort was vomiting on fast_pattern:only on a
> singular content match with a PCRE -- see my earlier quoted reply.  Thanks
> 

There’s nothing wrong with what you wrote.  Works fine for me.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4881 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20141006/fd6467ba/attachment.bin>


More information about the Snort-sigs mailing list