diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex index 23111c0..322cbc6 100644 --- a/doc/snort_manual.tex +++ b/doc/snort_manual.tex @@ -15238,13 +15238,19 @@ P, H, D, M, C, K, S and Y. \subsubsection{Example} -This example performs a case-insensitive search for the string BLAH in the payload. +This example performs a case-insensitive search for the HTTP URI \texttt{foo.php?id=} \begin{verbatim} - alert ip any any -> any any (pcre:"/BLAH/i";) + alert tcp any any -> any 80 (content:"/foo.php?id="; pcre:"/\/foo.php?id=[0-9]{1,10}/iU";) \end{verbatim} \begin{note} +It is wise to have at least one \texttt{content} keyword in a rule that uses \texttt{pcre}. This +allows the fast-pattern matcher to filter out non-matching packets so that the pcre evaluation is +not performed on each and every packet coming across the wire. +\end{note} + +\begin{note} Snort's handling of multiple URIs with PCRE does not work as expected. PCRE when used without a \texttt{uricontent} only evaluates the first URI. In order