restored expected snort scan behavior with non-capturing group