[Snort-sigs] Question about content

Nigel Houghton nhoughton at ...435...
Tue Dec 1 08:33:43 EST 2009


On Tue, Dec 1, 2009 at 4:11 AM, sofia insat <sofia.insat at ...174...> wrote:
>
> Hi,
>
> I want to detect the last word in the content
> for exemple if I have this bytes: ....1245643577AAAA
> how can I verify that it contains "AAAA" at the end without knowing the total size of bytes
>
>
>
> ------------------------------------------------------------------------------
> Join us December 9, 2009 for the Red Hat Virtual Experience,
> a free event focused on virtualization and cloud computing.
> Attend in-depth sessions from your desk. Your couch. Anywhere.
> http://p.sf.net/sfu/redhat-sfdev2dev
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>

Again, this looks like a homework assignment. This list is not the
place for homework questions.

The answers you seek can be found in the Snort manual and the
associated README files in the Snort tarball. You need to do some work
and read the documentation.

--
Nigel Houghton
Head Mentalist
SF VRT
http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/




More information about the Snort-sigs mailing list