[Snort-sigs] Offset

Devilscrow Sr devilscrow at ...2071...
Mon Dec 15 04:30:01 EST 2003


Hi Martin,

The offset keyword starts searching from the beginning of the payload.

check out - http://www.snort.org/docs/writing_rules/

    -dev

Martin Olsson wrote:

>Quick question:
>
>Is the "offset" keyword based on the beginning of the frame or the
>beginning of the protocol payload?
>...................
>/Martin
>




More information about the Snort-sigs mailing list