[Snort-users] exact phrase match

Brian bmc at ...950...
Tue Dec 16 05:19:05 EST 2003


On Mon, Dec 15, 2003 at 11:56:34PM -0600, Paul Schmehl wrote:
> --On Monday, December 15, 2003 20:02:20 -0500 Brian <bmc at ...950...> wrote:
> >
> >Try... pcre.  :)
> >
> >content:"nc.exe"; pcre:"/\wnc.exe\w/";
> >
> Brian, you're the man, but shouldn't that be:
> content:'nc.exe'; pcre:'/\Wnc.exe\W/';

Oops, typo on my part.  No, it should be...

    content:"nc.exe"; pcre:"/\bnc.exe\b/";

Brian




More information about the Snort-users mailing list