[Snort-devel] Snort content usage

Peter Schmitz mosquitooth at ...224...
Sat Feb 5 08:10:22 EST 2005


while reading the new Snort documentation I encountered some small
questions, that perhaps someone in this mailing list can answer to me:

When several contents are specified, and, let's say, the first content
matches, does the search for the second content start at the beginning of
the payload, or at the position the first buffer was found?

Just the same with all the other content-related key words (esp. depth). Are
these relative to the last content match - or absolute values?

Thanks for any help,


DSL Komplett von GMX +++ Supergünstig und stressfrei einsteigen!
AKTION "Kein Einrichtungspreis" nutzen: http://www.gmx.net/de/go/dsl

More information about the Snort-devel mailing list