[Snort-sigs] Negative offset?

L0rd Ch0de1m0rt l0rdch0de1m0rt at ...2420...
Tue Mar 3 14:06:02 EST 2015

Hey Joel,

In our thread from the other day (http://seclists.org/snort/2010/q2/838)
you said:

On Thu, Jun 10, 2010 at 11:20 AM, Joel Esler <jesler at ...435...> wrote:

> Plus with distance, you can do negative relativity, you can't do that with
> offset.  Just FYI.

This makes sense but the Snort manual says offset can be give a value
-65535 to 655535.  And while Snort does not throw an error with a negative
offset, I cant seem to think of how a negative offset would work.  I
thought maybe it would start from the end of the packet and go backwards
(kind of like python list indexing) but my tests don't show this.  Any
insight is appreciated.


-L0rd C
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20150303/927966dc/attachment.html>

More information about the Snort-sigs mailing list