Re: What does /R mean in pcre?

["Joel Esler \(jesler\) via Snort-users" <snort-users () lists snort org>]

Relative.  It means this match is relative to the end of the previous content match.  

So the content match before it sets the “pointer” or where Snort is at in its examination of the packet (or packets), 
the regular expression with the /R must occur after that.  

Sent from my  iPhone

> On Sep 1, 2019, at 08:27, fluency0726 via Snort-users <snort-users () lists snort org> wrote:
>
> 
> Hi all,
>        I'm trying to generate some traces that can trigger snort's alert to do some performance test. But when I read 
> some rules with pcre option, I met some regular expressions that I didn't understand. Like the screenshot I attached 
> shows, the regular expression contains sR after the string boundary character "/", I know that "s" is a modifier that 
> set PCRE_DOTALL, however, I don't know what does "R" mean here. I checked pcre docs and didn't find there's an "R" 
> modifier. So what does "R" mean here, is it a modifier or  something else? I'm very confused about it. I would be 
> very grateful if you can help me! Thx!
> <0C6C0076-797C-471D-B4F3-AA944834BFAD.png>
>
> Chang Liu
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>    To unsubscribe, send an email to:
>    snort-users-leave () lists snort org
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Attachment: smime.p7s
Description:

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette