[Snort-sigs] Sig help (Tumblr redirect)
william.metcalf at ...2420...
Tue Jul 3 18:30:18 EDT 2012
Yes. Why I said.. "and the pattern has nocase,". I just don't see a
down side to handling this in parsing, seems silly to leave it up to
the user to apply this logic under these conditions as I see no
downside to doing automagically.
On Tue, Jul 3, 2012 at 5:23 PM, <lists at ...3397...> wrote:
> On 07/03/12 17:11, Will Metcalf wrote:
>> What is the point of snort ever checking the
>> pattern twice under these conditions? Am I missing something there?
> Case sensitivity since the 'only' makes it nocase?
More information about the Snort-sigs