[Snort-users] Not a colon content match.
Scott A. McIntyre
scott at ...1050...
Fri Mar 30 11:20:49 EST 2001
I know that one should escape a ":" in content matches, but, I'm
currently unable to do a negation of a colon in a content match.
For example, if I wanted match:
I have tried:
content: "foobar"; content:!"|3a|foobar";
content: "foobar"; content:!"\:foobar";
But no permutation seems to cut it.
More information about the Snort-users