Re: [Snort-users] Dectecting Social Security Numbers?

At 02:01 PM 9/10/2004, Lyons, Jon wrote:
>I=92m trying to get snort to generate an alert for SS#=92s, I=92ve tried=
the=20
>rule below but no alerts are generated. I tested this with pcretest and it=
=20
>works=85am I missing something?
>alert tcp any any -> any any (msg:"Socail Security Number Clear Text";=20
>pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";)

I can't possibly imagine why that rule works with pcretest, but if you say=
=20
so... It's clearly not any valid regex syntax that I've ever seen before,=20
and it looks nothing like the regex syntax of any of the default rules in=20
the snort ruleset.

What's the m! out front supposed to be doing, and why isn't that PCRE=20
properly bounded with /'es? (all regexes should be bounded with a / at the=
=20
start and a / at the end, with modifiers following the trailing /)

try something more like this to start with, then add PCRE syntax as needed:

pcre:"/\d\d\d[-/]\d\d[-/]\d\d\d\d\b/"

Note: I substituted \b for your \Z. I don't think EOL is really a good=20
termination condition to use when doing general text string searches.. what=
=20
if it's in record-per-line format where the name comes after the SSN?



-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users