[Snort-users] Team0x42 Snort rules

Brian Caswell bmc at ...950...
Mon Apr 7 18:00:09 EDT 2008


On Apr 7, 2008, at 5:01 PM, TheWell wrote:
> Some good snort rules by Team0x42

Team B,

Really?

I see 5 rules that are all basically the same thing.  Perhaps you  
should update your regular expression to include all 5 cases you  
attempt to cover in 1 rule.

The following regular expression is released under the license to ill,  
however you may not use it unless you are in Brooklyn, and you did not  
sleep while traveling to said city.

(\%(60|3b|7c|00)|<)

Brian




More information about the Snort-users mailing list