[Snort-users] content options in Snort rule

Sonia K. Tsui sonia at ...8047...
Tue Jan 21 08:03:36 EST 2003


Hi,

As far as I understand, when Snort sees the content option, it will scan 
for signature against both header content and body content of http packet. 
Is there a way to tell whether the content signature is  for header 
content or body content? 

thanks
---Sonia





More information about the Snort-users mailing list