[Snort-users] Unusual characters in content option

Fermin Galan Marquez galan at ...3803...
Thu Oct 25 03:00:17 EDT 2001


Hello everyone.

I need to introduce non ASCII standar characters (but
used in lenguages like spanish or french) in content
rules, but Snort complaints about it.

I mean rules like this:

	content: "café";

So, I have to questions:

a) What characters can't be used in content rules? (in
addition to " ; and |)
b) How could I introduce these characters? (maybe escaping
them, but what ISO ASCII extension should I use?)

Thanks.

------------
Fermín Galán 
galan at ...3803...
http://www.dit.upm.es/~galan






More information about the Snort-users mailing list