[Snort-sigs] Sig help (Tumblr redirect)

Will Metcalf william.metcalf at ...2420...
Tue Jul 3 18:30:18 EDT 2012


Yes. Why I said.. "and the pattern has nocase,".  I just don't see a
down side to handling this in parsing, seems silly to leave it up to
the user to apply this logic under these conditions as I see no
downside to doing automagically.

Regards,

Will..

On Tue, Jul 3, 2012 at 5:23 PM,  <lists at ...3397...> wrote:
> On 07/03/12 17:11, Will Metcalf wrote:
>> What is the point of snort ever checking the
>> pattern twice under these conditions?  Am I missing something there?
>
> Case sensitivity since the 'only' makes it nocase?
>




More information about the Snort-sigs mailing list