[Snort-users] Question

Brian bmc at ...950...
Mon Apr 14 10:14:03 EDT 2003


On Fri, Apr 11, 2003 at 03:55:16PM -0700, Joe Hdez wrote:
> Hi, Mhh I would like to know if this signature is gonna work if I remove 
> the line byte_test:2,>,1024,0,relative,little 

Nope.

> I ask this because it?s not working with snort 1.9.1 through snortcenter, 
> it doesn?t have that field. I?d appreciate your help, Joe 

It is a 2.0 rule only.

-brian




More information about the Snort-users mailing list