[Snort-sigs] Offset

Devilscrow Sr devilscrow at ...2071...
Mon Dec 15 05:14:00 EST 2003


Hi Dirk,

Precisely when we say payload we usually mean the data in the packet 
that in other words it is the TCP/UDP Payload.

- dev

Dirk Geschke wrote:

>Hi dev,
>
>  
>
>>The offset keyword starts searching from the beginning of the payload.
>>
>>check out - http://www.snort.org/docs/writing_rules/
>>    
>>
>
>the question is which payload...
>...........
>
>(Otherwise most rules won't make any sense...)
>
>Regards
>
>Dirk
>  
>




More information about the Snort-sigs mailing list