[Snort-users] pcre usage for inline

Joel Esler eslerj at ...11827...
Wed Jun 15 13:26:03 EDT 2005


Just wondering, since we have the ability to modify items with regular
expressions...  can it be done in a snort rule?  like..

pcre:"s/stuff/newstuff/";

just a thought..  be able to modify actual data on the fly...

J




More information about the Snort-users mailing list