[Snort-sigs] Question on http_client_body

James Lay jlay at ...3266...
Mon Jul 2 08:50:26 EDT 2012


Hey all,

I'm trying to find out if there's a content matching option to start searching a packet AFTER the http header.  I see http_client_body comes close, but this matches the client request…is there something I can use to match the server response?  Thanks all.

James



More information about the Snort-sigs mailing list