[Snort-users] Trouble with home-made rule

Brian Caswell bmc at ...312...
Mon Jun 18 02:26:52 EDT 2001

Dragos Ruiu wrote:
> Your problem is with the backslash before the quote....
> \" is how you escape a quote inside the content string
> so it looks like an unterminated string to the parser.
> try:
> "C:\\"
> and remember to add another rule for lowercase:
> "c:\\"

Or just use the keyword nocase.

Brian Caswell
The MITRE Corporation

More information about the Snort-users mailing list