[Snort-sigs] [Emerging-Sigs] what s the real difference here?

Joel Esler jesler at ...435...
Tue Jul 13 19:10:21 EDT 2010


On Jul 13, 2010, at 6:58 PM, waldo kitty wrote:
> 
> On 7/13/2010 18:40, Joel Esler wrote:
>> CC'ing Snort-Sigs list:
>> 
>> Copy and paste out of the manual for http_uri:
>> 
>> "Using a content rule option followed by a http uri modifier is the same as using a uricontent by itself."
> 
> that's what i thought... so... if i may be so bold... why the change in format? 
> which is better? is one preferred over the other? which one?

Not sure of the reasoning behind it.  Maybe a Devel or VRT can chime in on that one.



More information about the Snort-sigs mailing list