[Snort-users] not content rules

Martin Roesch roesch at ...421...
Fri Apr 6 13:53:12 EDT 2001


alert tcp any any -> any any (content: !"foo"; msg: "not content
match";)

That'll work.

Raphael LUDWIG wrote:
> 
> who can i make a rules with a NOT content ?
> 
> --
> Raphael
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list