On 1/7/11 3:24 PM, "Kris Deugau" <kdeu...@vianet.ca> wrote:
> Can anyone tell me how this rule:
>
>
> mimeheader T_YOUR_ORDER_VIRUS_L Subject =~
/(?:Incoming|Information|Twitter)? ?(?:Message|Ticket)? \#\d+/
You have ? On the first three elements, which means zero-or-one instances..
So, since Incoming|Information|Twitter is optional, the space is optional,
and Message|Ticket is optional, the only thing required in this whole rule
is a space, a literal hash, and one or more digits.
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281
