[Snort-sigs] Negative offset?

L0rd Ch0de1m0rt l0rdch0de1m0rt at ...2420...
Tue Mar 3 14:06:02 EST 2015


Hey Joel,

In our thread from the other day (http://seclists.org/snort/2010/q2/838)
you said:


On Thu, Jun 10, 2010 at 11:20 AM, Joel Esler <jesler at ...435...> wrote:

>
>
> Plus with distance, you can do negative relativity, you can't do that with
> offset.  Just FYI.
>
>
>
>

This makes sense but the Snort manual says offset can be give a value
-65535 to 655535.  And while Snort does not throw an error with a negative
offset, I cant seem to think of how a negative offset would work.  I
thought maybe it would start from the end of the packet and go backwards
(kind of like python list indexing) but my tests don't show this.  Any
insight is appreciated.

Cheers,

-L0rd C
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20150303/927966dc/attachment.html>


More information about the Snort-sigs mailing list