[Snort-devel] Feature request: isdataat ability in specific (preprocessor) buffers

L0rd Ch0de1m0rt l0rdch0de1m0rt at ...2499...
Wed Nov 6 15:03:47 EST 2013


On Thu, Oct 24, 2013 at 8:21 AM, Joel Esler <jesler at ...402...> wrote:

> :)
>
> Yes. But all of that is part of something bigger.  It'll all come together.
>
> You can kinda trick http_uri/isdataat with a urilen. Not the same thing,
> but if used properly can have the same effect.
>
>
Hello.

Joel, this may have been fixed in recent versions but based on our previous
thread ("Touched by a proxy: thoughts on urilen?"), urilen isn't useful for
proxy environments --

https://lists.emergingthreats.net/pipermail/emerging-sigs/2013-February/021487.html

Cheers,

Lord C.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20131106/ce17436b/attachment.html>


More information about the Snort-devel mailing list