Re: Testing the quickness of signature writers

[Brian Caswell <bmc () snort org>]

On May 2, 2006, at 2:20 PM, M. Shirk wrote:
> > >> pcre:"/[\? \x3b\x26]module=[a-zA-Z0-9]*[^\x3b\x26]/U";
> >
> >   A forward slash, followed by any one char from the set ('?',  
> > ';', '&')
> > followed by the literal text "module=" followed by any number  
> > (zero or more)
> > alphanumerics followed by any char that is neither ';' nor '&'.   
> > All matched
> > against the decoded URI buffer.
>
> That space after the \? will be evaluated in the character set and  
> the forward slash acts as the bracket for the pcre expression.

In the rule I originally sent, there was no space in the character  
set.  Probably added accidentally when dave copied it in his response.

Brian