RE: [PHP] Can I do this in a single match/replace?

2012-06-28 Thread Ford, Mike
> -Original Message- > From: Paul Halliday [mailto:paul.halli...@gmail.com] > Sent: 28 June 2012 02:27 > Using preg_match and this pattern I can get the refs: > > $pattern = '\reference:url,([^;]+;)\'; > > which gives me: > > $matches[0] = www.ndmp.org/download/sdk_v4/draft-skardal-nd

Re: [PHP] Can I do this in a single match/replace?

2012-06-27 Thread Chris Testroet
On 6/27/2012 6:26 PM, Paul Halliday wrote: I have lines that look like (I added intentional line breaks): alert tcp $HOME_NET 1 -> $EXTERNAL_NET any (msg:"ET EXPLOIT NDMP Notify Connect - Possible Backup Exec Remote Agent Recon"; flow:established,from_server; content:"|00 00 05 02|"; offset:

[PHP] Can I do this in a single match/replace?

2012-06-27 Thread Paul Halliday
I have lines that look like (I added intentional line breaks): alert tcp $HOME_NET 1 -> $EXTERNAL_NET any (msg:"ET EXPLOIT NDMP Notify Connect - Possible Backup Exec Remote Agent Recon"; flow:established,from_server; content:"|00 00 05 02|"; offset:16; depth:20; content: "|00 00 00 03|"; offse