[Snort-devel] protected_content and replace?

Joshua Kinard kumba at ...2185...
Sat Oct 25 23:47:03 EDT 2014


I see this note in the manual for protected_content:

The protected content keyword can be used with some (but not all) of the
content modifiers. Those not
supported include:
nocase
fast_pattern
depth
within

I assume 'replace' should be on that list as well?  It's always been in a
different section of the manual, but it seems to behave like a modifier
keyword, since it affects the previous content match.

Thanks!,

-- 
Joshua Kinard
Gentoo/MIPS
kumba at ...2185...
4096R/D25D95E3 2011-03-28

"The past tempts us, the present confuses us, the future frightens us.  And our
lives slip away, moment by moment, lost in that vast, terrible in-between."

--Emperor Turhan, Centauri Republic




More information about the Snort-devel mailing list