[Snort-sigs] Question on http_client_body

James Lay jlay at ...3266...
Mon Jul 2 10:11:42 EDT 2012

On 2012-07-02 06:50, James Lay wrote:
> Hey all,
> I'm trying to find out if there's a content matching option to start
> searching a packet AFTER the http header.  I see http_client_body
> comes close, but this matches the client request…is there something I
> can use to match the server response?  Thanks all.
> James
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. 
> Discussions
> will include endpoint security, mobile security and the latest in 
> malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
> Please visit http://blog.snort.org for the latest news about Snort!

Thanks Will and Nathan....I've read the snort manual on this and 
apparently just seemed to not parse the info right....heh..it's a Monday 


More information about the Snort-sigs mailing list