pcre
Use the pcre keyword to specify the content to match using Perl Compatible Regular Expression (PCRE). For the PCRE syntax, please refer to http://perldoc.perl.org/perlre.html.
The pattern to be matched must be enclosed in double quotation marks and followed by a semicolon. Certain special characters must be written as noted in the table below.
|
Special character |
Expression |
|---|---|
|
" |
|
|
; |
|
|
/ |
|
|
The IPS Engine handles PCRE a lot slower compared to normal pattern matching. PCRE should be used very carefully, especially for signatures that detect traffic from HTTP servers or traffic that does not specify a port. |
Syntax:
--pcre [!]"/<regular expression>/[<op>]";
The optional use of [!] indicates the content is matched if it does not appear.
|
<op> |
Description |
|---|---|
|
|
Case insensitive |
|
|
Include new lines in the dot (.) meta character |
|
|
By default, the string is treated as one big line of characters. |
|
|
White space data characters in the pattern are ignored except when escaped or inside a character class. |
|
|
The pattern must match only at the start of the buffer (same as |
|
|
Set |
|
|
Inverts the greediness of the quantifiers so that they are not greedy by default, but become greedy if followed by " |
Example:
--pcre "/\sLIST\s[^\n]*?\s\{/smi";