[Snort-sigs] Content matching question
jlay at ...3266...
Mon Jan 20 15:22:08 EST 2014
On 2014-01-20 10:58, James Lay wrote:
> Hey all,
> So....I'm trying to figure out how to really NOT match certain
> but match if the data size is longer then expected. Example:
> I have a packet where the usual data size is say 20 bytes and
> the word "bleh". I know I can content:!"bleh" and away I go. But
> that packet is 30 bytes? That I'd like to see, regardless if it has
> content "bleh" or not.
> What are my options? Byte_test? It's not http, so any options with
> that were out. Thanks for any guidance.
Turns out dsize was just what I needed:
More information about the Snort-sigs