[Bro-Dev] case-insensitive patterns

Vern Paxson vern at corelight.com
Fri Jun 29 12:26:34 PDT 2018

> Just so I have this right: it looks like the preferred would not be
> /(?i foo)/ but rather /(?i)foo/, yes?

Oh and to follow up on this, so in PCRE does /x((?i)bar)foo/ make the "foo"
part case-insensitive too, or not?  It's not obvious to me from the page
you pointed me at, and I don't have an environment set up to definitively
test this.


More information about the bro-dev mailing list