[Snort-users] Trouble with home-made rule
dr at ...381...
Sun Jun 17 19:37:40 EDT 2001
On Monday 18 June 2001 06:26, Brian Caswell wrote:
> Dragos Ruiu wrote:
> > Your problem is with the backslash before the quote....
> > \" is how you escape a quote inside the content string
> > so it looks like an unterminated string to the parser.
> > try:
> > "C:\\"
> > and remember to add another rule for lowercase:
> > "c:\\"
> Or just use the keyword nocase.
Duh.... it's late... I need sleep.
More information about the Snort-users