RE:[Snort-sigs] PCRE for SS#'s

From: "Harper, Patrick" <patrick.harper@phns.com>
> Someone on the snort-users list asked how to detect SS numbers in a
> snort rule, I put the one I wrote out there and was quickly reminded how
> lacking my PCRE kung foo is.  With the input of the reformed rules nazi
> and a few others I got some input that helped me re-write the PCRE for
> it and I wanted to run it past this list and put it out for anyone that
> it might help.
>
> /\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b/

Effectively the same but shorter:

/\b\d{3}-\d{2}-\d{4}\b/

Word boundaries are probably the best delimiters in general but you might
be able to create a more precise pattern if you already know the format
and/or protocol where SSN's might show up.

Cheers,
nnposter


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs