[Snort-users] Trouble with home-made rule

Brian Caswell bmc at ...312...
Mon Jun 18 02:26:52 EDT 2001


Dragos Ruiu wrote:
> 
> Your problem is with the backslash before the quote....
> \" is how you escape a quote inside the content string
> so it looks like an unterminated string to the parser.
> 
> try:
> 
> "C:\\"
> 
> and remember to add another rule for lowercase:
> 
> "c:\\"

Or just use the keyword nocase.


-- 
Brian Caswell
The MITRE Corporation




More information about the Snort-users mailing list