[Snort-users] Rule creation: content keyword

mosquitooth at ...158... mosquitooth at ...158...
Sun Feb 6 11:15:20 EST 2005


Hi,

just one question: If I specify more than one "content:"[x]"" keyword in a
snort rule - are these content patterns relative towards each other? If so,
where does a new search for e.g. the second pattern start? At the last byte
of the last (e.g. first) successful match?


Thanks if someone can enlight me,

Peter

-- 
Lassen Sie Ihren Gedanken freien Lauf... z.B. per FreeSMS
GMX bietet bis zu 100 FreeSMS/Monat: http://www.gmx.net/de/go/mail




More information about the Snort-users mailing list