[Snort-users] Trouble with home-made rule

Dragos Ruiu dr at ...381...
Sun Jun 17 19:37:40 EDT 2001


On Monday 18 June 2001 06:26, Brian Caswell wrote:
> Dragos Ruiu wrote:
> > Your problem is with the backslash before the quote....
> > \" is how you escape a quote inside the content string
> > so it looks like an unterminated string to the parser.
> >
> > try:
> >
> > "C:\\"
> >
> > and remember to add another rule for lowercase:
> >
> > "c:\\"
>
> Or just use the keyword nocase.

Duh.... it's late... I need sleep.

thanks,
--dr




More information about the Snort-users mailing list