[Snort-sigs] PCRE /PR modifiers

Y M snort at ...3751...
Tue Jul 7 14:06:13 EDT 2015



> From: lists at ...3397...
> To: snort at ...3751...; snort-sigs at lists.sourceforge.net
> Subject: Re: [Snort-sigs] PCRE /PR modifiers
> Date: Tue, 7 Jul 2015 13:02:37 -0500
> 
> On 07/07/15 12:56, Y M wrote:
> > content:"ABC|3A|"; http_client_body; pcre:"/(doA|doB|doC)/PR"; and this is where
> > I got the error.
> 
> pcre:"/do[ABC]/R" maybe?

This is definitely a better way to do it, appreciate the feedback. I will test this with the /PR modifiers since this is where I get the error message.
Thanks again.YM 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20150707/ef1a9d1d/attachment.html>


More information about the Snort-sigs mailing list