[Snort-users] Rule creation: content keyword

mosquitooth at ...158... mosquitooth at ...158...
Sun Feb 6 11:15:20 EST 2005


just one question: If I specify more than one "content:"[x]"" keyword in a
snort rule - are these content patterns relative towards each other? If so,
where does a new search for e.g. the second pattern start? At the last byte
of the last (e.g. first) successful match?

Thanks if someone can enlight me,


Lassen Sie Ihren Gedanken freien Lauf... z.B. per FreeSMS
GMX bietet bis zu 100 FreeSMS/Monat: http://www.gmx.net/de/go/mail

More information about the Snort-users mailing list