[Snort-sigs] Rule #501 (lssre)

dank at ...1581... dank at ...1581...
Tue Jun 10 05:33:14 EDT 2003

I've been looking at rule #501, which differs from 500 by substituting
"lssre" for "lssr".  I can't find any description of "lssre" in the
snort rule-writing guide, and the code seems to lump it in with lssr
wholly:  a grep for IPOPT_LSRR_E shows it being used in src/plubase.c
and src/log.c in the exact same manner as IPOPT_LSRR.

Can any snort gurus shed some light on the situation?  I can't guess
anything from my understanding of IP options.

nick black <dank at ...1582...>
"np:  nondeterministic polynomial-time
the class of dashed hopes and idle dreams." - the complexity zoo

More information about the Snort-sigs mailing list