[Snort-sigs] Quick question about byte_test

Jeffrey Stebelton jstebelton at ...3769...
Tue Feb 12 14:49:30 EST 2013


When byte_test follows byte_extract, does a relative offset start after the number of bytes put into the variable in byte_extract or a previous content match before the byte_extract? And if it's the latter, then there would have to be at least one content match before the byte_extract?

Jeff


*** *** ***
This message contains information which may be confidential and privileged. Unless you are the addressee (or authorized to receive for the addressee), you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received the message in error,  please advise the sender by reply e-mail and delete the message.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20130212/df325886/attachment.html>


More information about the Snort-sigs mailing list