[Snort-devel] depth, content-list bugs?
grundsch at ...64...
Wed Jul 30 12:49:06 EDT 2003
I understood it like you did, and this has a consequence: any rule,
where the "content" pattern is bigger than the given "depth", should
never match... (the opposite is ok)
Now the question is about the "should"... but as you said, the first
counter example is with depth:0
On Mercredi, juil 30, 2003, at 18:04 Europe/Zurich, Andrew Chi wrote:
> so in practice depth really specifies "the maximum offset into the
> payload that the end of the content could match."
More information about the Snort-devel