Snort mailing list archives
Re: Hello,
From: "Joel Esler (jesler)" <jesler () cisco com>
Date: Fri, 22 Jul 2016 17:26:07 +0000
You can't use a variable from a byte_extract within a pcre. We can probably help you with what you are trying to do, if you have a pcap and describe the problem. -- Joel Esler iPhone On Jul 22, 2016, at 1:24 PM, Rodrigo Borges Pereira <rodrigoborgespereira () gmail com<mailto:rodrigoborgespereira () gmail com>> wrote: Is there a way to limit the depth of a pcre search? I can use byte_extract to get the length of a variable buffer to which the pcre expression should apply, but there doesn't seem to be an option to do this. Appreciate any hints. Rgds. ------------------------------------------------------------------------------ What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using capacity planning reports.http://sdm.link/zohodev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net> Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using capacity planning reports.http://sdm.link/zohodev2dev
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Hello, Rodrigo Borges Pereira (Jul 22)
- Re: Hello, Joel Esler (jesler) (Jul 22)
- Re: Hello, Rodrigo Borges Pereira (Jul 22)
- Re: Hello, Rodrigo Borges Pereira (Jul 22)
- Re: Hello, Joel Esler (jesler) (Jul 22)
- Re: Hello, Hui cao (Jul 22)
- Re: Hello, Rodrigo Borges Pereira (Jul 22)
- Re: Hello, Rodrigo Borges Pereira (Jul 22)
- Re: Hello, Rodrigo Borges Pereira (Jul 22)
- Re: Hello, Joel Esler (jesler) (Jul 22)