[Snort-users] Not a colon content match.

Scott A. McIntyre scott at ...1050...
Fri Mar 30 11:20:49 EST 2001


Hi,

I know that one should escape a ":" in content matches, but, I'm
currently unable to do a negation of a colon in a content match.

For example, if I wanted match:

content: "foobar";

but not

content: ":foobar";

I have tried:

content: "foobar"; content:!"|3a|foobar";
content: "foobar"; content:!"\:foobar";

But no permutation seems to cut it.

Ideas?

Thanks.

Scott




More information about the Snort-users mailing list