[Snort-users] content options in Snort rule

Chris Green cmg at ...1935...
Tue Jan 21 10:36:02 EST 2003

"Sonia K. Tsui" <sonia at ...8047...> writes:

> Hi,
> As far as I understand, when Snort sees the content option, it will scan 
> for signature against both header content and body content of http packet. 
> Is there a way to tell whether the content signature is  for header 
> content or body content?

No, the only content that is "special" right now is uricontent when
does the portion up to the HTTP version
Chris Green <cmg at ...1935...>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx

More information about the Snort-users mailing list