[Snort-devel] depth, content-list bugs?

stephane grundsch at ...64...
Wed Jul 30 12:49:06 EDT 2003


I understood it like you did, and this has a consequence: any rule, 
where the "content" pattern  is bigger than the given "depth", should 
never match... (the opposite is ok)
Now the question is about the "should"... but as you said, the first 
counter example is with depth:0

On Mercredi, juil 30, 2003, at 18:04 Europe/Zurich, Andrew Chi wrote:
>
> so in practice depth really specifies "the maximum offset into the
> payload that the end of the content could match."





More information about the Snort-devel mailing list