[Snort-sigs] And-ing content

Opus opus at ...216...
Wed Jun 12 07:36:07 EDT 2002


Thank you for such a quick response!

-Opus

On Wed, 12 Jun 2002, Chris Green wrote:

> Opus <opus at ...216...> writes:
>
> > Can boolean ANDs be done with the content option?  If so, what is
> > the
>
> content: "a"; content: "b"; checks for them in the same datablock.
>
> for boolean OR, write multiple rules :)
>

-- 
    .~.
    /V\
   /( )\
   ^^-^^





More information about the Snort-sigs mailing list