pcre
Syntax: --pcre [!]"/<regex>/[ismxAEGRUB]";
Description:
Similarly to the pattern keyword, use the pcre keyword to specify a pattern using Perl-compatible regular expressions (PCRE). A pcre keyword can be followed by a context keyword to define where to look for the pattern in the packet. If no context keyword is present, the FortiGate unit looks for the pattern anywhere in the packet buffer. For more information about PCRE syntax, go to http://www.pcre.org.
The switches include:
• i: Case insensitive.
• s: Include newlines in the dot metacharacter.
• m: By default, the string is treated as one big line of characters. ^ and $ match at the beginning and ending of the string. When m is set, ^ and $ match immediately following or immediately before any newline in the buffer, as well as the very start and very end of the buffer.
• x: White space data characters in the pattern are ignored except when escaped or inside a character class.
• A: The pattern must match only at the start of the buffer (same as ^ ).
• E: Set $ to match only at the end of the subject string. Without E, $ also matches immediately before the final character if it is a newline (but not before any other newlines).
• G: Invert the “greediness” of the quantifiers so that they are not greedy by default, but become greedy if followed by ?.
• R: Match relative to the end of the last pattern match. (Similar to distance:0;).
• U: Deprecated, see the context keyword. Match the decoded URI buffers.