[Snort-users] Which is the escape character in content option?

roman at ...438... roman at ...438...
Sun Oct 21 10:41:04 EDT 2001


* Escape via hex encoding

content: "Location | 7c | http | 3b | web";

* Escape via backspace   

content: "Location\| http\; web";

cheers,
Roman

On Sun, 21 Oct 2001, Fermin Galan Marquez wrote:
 
> 
> Hello everyone.
> 
> Characters ", | and ; must be escaped inside a content 
> option (as it's told on User Manual section 2.3.9), but
> which is this escape character?
>
> For example, how the following rule should be written?
>
>       content: "Location| http; web";
> 
> Thanks.
> 
> --------
> Fermin Galan
> galan at ...3803...
>
http://www.dit.upm.es/~galan


---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/






More information about the Snort-users mailing list