[Snort-sigs] Getting an exact match on content

Guillaume guillaume at ...210...
Fri Nov 30 06:23:07 EST 2001


En réponse à Brian <bmc at ...95...>:

> Instead of:
>    content:"anal"; nocase;
> Use:
>    content:"anal "; nocase;

Maybe dump questions: 
- would this match the word "banal " ?
- does it mean there is no way to match exact word or content except using work-
arounds ?
- is there "à la regexp" implementation planned for snort ?

Best regards,

Guillaume

***********************************
Sent with HORDE/IMP (www.horde.org)




More information about the Snort-sigs mailing list