[Snort-users] /smi at the end of pcre statements

Stephen Mullins steve.mullins.work at ...11827...
Mon Mar 16 13:19:21 EDT 2009


Thanks, that will come in handy, especially the Snort specific portion.

The "/smi" question is still stumping me and some of my colleagues.

On Mon, Mar 16, 2009 at 12:56 PM, Matt Olney <molney at ...1935...> wrote:
> From some code I have stashed away for reference:
>
>      switch(*opts) {
>       case 'i':  compile_flags |= PCRE_CASELESS;            break;
>       case 's':  compile_flags |= PCRE_DOTALL;              break;
>       case 'm':  compile_flags |= PCRE_MULTILINE;           break;
>       case 'x':  compile_flags |= PCRE_EXTENDED;            break;
>
>           /*
>            * these are pcre specific... don't work with perl
>            */
>       case 'A':  compile_flags |= PCRE_ANCHORED;            break;
>       case 'E':  compile_flags |= PCRE_DOLLAR_ENDONLY;      break;
>       case 'G':  compile_flags |= PCRE_UNGREEDY;            break;
>
>           /*
>            * these are snort specific don't work with pcre or perl
>            */
>       case 'R':  pcre_data->options |= SNORT_PCRE_RELATIVE; break;
>       case 'U':  pcre_data->options |= SNORT_PCRE_HTTP_URI; break;
>       case 'B':  pcre_data->options |= SNORT_PCRE_RAWBYTES; break;
>       case 'P':  pcre_data->options |= SNORT_PCRE_HTTP_BODY;  break;
>       case 'O':  pcre_data->options |= SNORT_OVERRIDE_MATCH_LIMIT; break;
>       case 'H':  pcre_data->options |= SNORT_PCRE_HTTP_HEADER;  break;
>       case 'M':  pcre_data->options |= SNORT_PCRE_HTTP_METHOD;  break;
>       case 'C':  pcre_data->options |= SNORT_PCRE_HTTP_COOKIE;  break;
>
> On Mon, Mar 16, 2009 at 12:32 PM, Stephen Mullins
> <steve.mullins.work at ...11827...> wrote:
>> All,
>>
>> What does the /smi portion of a pcre statement signify?
>>
>> Any information anyone can provide would be appreciated.
>>
>> Thanks,
>>
>> Steve Mullins
>>
>> ------------------------------------------------------------------------------
>> Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
>> powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
>> easily build your RIAs with Flex Builder, the Eclipse(TM)based development
>> software that enables intelligent coding and step-through debugging.
>> Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>>
>




More information about the Snort-users mailing list