[Snort-sigs] Issue with pcre

lists at ...3397... lists at ...3397...
Mon Oct 6 19:35:36 EDT 2014


On 10/06/2014 06:29 PM, waldo kitty wrote:
> something else to consider is if you really need a pcre with that rule... the 
> content match looks pretty definite... speaking of that, your pcre, both, do not 
> include the trailing '/'...

Yeah they do, PCRE from my reply minus the /U URI buffer Snort-centric PCRE
modifier:

PCRE version 8.12 2011-01-15

  re> /\/trackback\/$/i
data> http://example.com/trackbackmeowmeow
No match
data> http://example.com/trackback
No match
data> http://example.com/trackback/
 0: /trackback/
data> ^C

Cheers,
Nathan





More information about the Snort-sigs mailing list