[Snort-users] content options in Snort rule

Sonia K. Tsui sonia at ...8047...
Tue Jan 21 08:03:36 EST 2003


As far as I understand, when Snort sees the content option, it will scan 
for signature against both header content and body content of http packet. 
Is there a way to tell whether the content signature is  for header 
content or body content? 


More information about the Snort-users mailing list