[Snort-sigs] Sig help (Tumblr redirect)

lists at ...3397... lists at ...3397...
Tue Jul 3 18:33:11 EDT 2012

On 07/03/12 17:30, Will Metcalf wrote:
> Yes. Why I said.. "and the pattern has nocase,".  I just don't see a
> down side to handling this in parsing, seems silly to leave it up to
> the user to apply this logic under these conditions as I see no
> downside to doing automagically.

I apologize, I missed that entirely.  Yes, I agree with you, seems an easy
win/optimization here.


More information about the Snort-sigs mailing list