Re: [Snort-users] Team0x42 Snort rules

On Mon, April 7, 2008 6:00 pm, Brian Caswell wrote:
> On Apr 7, 2008, at 5:01 PM, TheWell wrote:
>> Some good snort rules by Team0x42
>
> Team B,
>
> Really?
>
> I see 5 rules that are all basically the same thing. Perhaps you
> should update your regular expression to include all 5 cases you
> attempt to cover in 1 rule.
>
> The following regular expression is released under the license to ill,
> however you may not use it unless you are in Brooklyn, and you did not
> sleep while traveling to said city.
>
> (\%(60|3b|7c|00)|<)
>

You owe me a new keyboard, Brian.

Randy



-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Register now and save $200. Hurry, offer ends at 11:59 p.m.,
Monday, April 7! Use priority code J8TLD2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users