[Snort-sigs] [Emerging-Sigs] what's the real difference here?

Joel Esler jesler at ...435...
Tue Jul 13 18:40:45 EDT 2010


CC'ing Snort-Sigs list:

Copy and paste out of the manual for http_uri:

"Using a content rule option followed by a http uri modifier is the same as using a uricontent by itself."

Joel

On Jul 13, 2010, at 5:59 PM, waldo kitty wrote:

> 
> what's the real difference between these two formats?
> 
> uricontent:"/register";
> 
> content:"/register"; http_uri;
> 
> 
> is http_uri taking the place of uricontent?
> 
> does http_uri cause the rule to trigger or break out sooner?
> 




More information about the Snort-sigs mailing list