[Snort-sigs] Strange PCRE usage in standard snort rules

Hi all,

I've noticed some strange usage of PCRE in the netbios.rules. For 
instance, rule 2937 has the following construct:

    pcre:"/^.{27}/R";
    content:"&|00|"; distance:29; within:2;

which uses the PCRE matcher to move the current match position forward
by 27 characters and then has a 2 byte content match a further 29 
characters on in the packet (I think thats correct).

Couldn't this be replaced by something far simpler which avoids usage
of the PCRE engine? Maybe something like:

    byte_test: 2, =, 9728, 56, big, relative;

where

    9728 == ordinal value of '&' times 256
    56 == 27 + 29

Wouldn't matching this modified construct place far less load on Snort's
detection engine?

Cheers,
Erik
-- 
-------------------------------------------------------
[N] Erik de Castro Lopo, Senior Computer Engineer
[E] erik.de.castro.lopo@sensorynetworks.com
[W] http://www.sensorynetworks.com
[T] +61 2 83022726
[F] +61 2 94750316
[A] L6/140 William St, East Sydney NSW 2011, Australia
-------------------------------------------------------
A good debugger is no substitute for a good test suite.


-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.
Get your fingers limbered up and give it your best shot. 4 great events, 4
opportunities to win big! Highest score wins.NEC IT Guy Games. Play to
win an NEC 61 plasma display. Visit http://www.necitguy.com/?r=20
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs