[Snort-users] content options in Snort rule
cmg at ...1935...
Tue Jan 21 10:36:02 EST 2003
"Sonia K. Tsui" <sonia at ...8047...> writes:
> As far as I understand, when Snort sees the content option, it will scan
> for signature against both header content and body content of http packet.
> Is there a way to tell whether the content signature is for header
> content or body content?
No, the only content that is "special" right now is uricontent when
does the portion up to the HTTP version
Chris Green <cmg at ...1935...>
I've had a perfectly wonderful evening. But this wasn't it.
-- Groucho Marx
More information about the Snort-users