[Snort-devel] Snort decoder

Ron Sal nsamurain at ...2499...
Mon Jan 26 08:20:36 EST 2015


> my problem is that if i want to match on multiple content within the
> base64 decoded data ( done by preprocessor, file_data) its like there is
> a limit for maximum distance between the contents.
> 
> 2 content with 10024 bytes between and that is not working
> but 2 content with 2016 between is working
> Is there a limit? can i read about it? is it configurable?

/Ronnie




More information about the Snort-devel mailing list