Re: proper rule writing for N

[Daniel McDonald]

On 10/21/11 11:21 AM, "Bowie Bailey" <bowie_bai...@buc.com> wrote:

> On 10/21/2011 12:16 PM, Bret Miller wrote:
>> You could say
>> header  __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/I

Indeterminate length matches are almost never good.  How about something
like:
header  __LOCAL_MAILENGINE ALL =~ /\bmailengine[[:alnum:]]{1,3}?\.com/i


-- 
Daniel J McDonald, CCIE # 2495, CISSP # 78281