[Snort-users] Signature question

Joel Esler jesler at ...1935...
Thu Feb 4 10:01:26 EST 2010

No, you can use the "R" pcre modifier which makes the pcre 'relative' to the
last content match.  You can't use depth, offset, distance, or within with


On Thu, Feb 4, 2010 at 8:01 AM, spiffy pickle <spiffypickle at ...11827...>wrote:

> Hello everyone,
>   I have a question using pcre with depth, offset, distance, and within
> qualifiers. I can't seem to find any documentation pointing one way or the
> other. Can you use those qualifiers with pcre? Does the pcre engine care
> about the where the content match pointer is pointing?
> Much thanks,
>    SP
> ------------------------------------------------------------------------------
> The Planet: dedicated and managed hosting, cloud storage, colocation
> Stay online with enterprise data centers and the best network in the
> business
> Choose flexible plans and management services without long-term contracts
> Personal 24x7 support from experience hosting pros just a phone call away.
> http://p.sf.net/sfu/theplanet-com
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Joel Esler
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100204/c66d5fd4/attachment.html>

More information about the Snort-users mailing list