[Snort-users] Rule creation: content keyword

Edin Dizdarevic Edin.Dizdarevic at ...7509...
Sun Feb 6 14:23:41 EST 2005


mosquitooth at ...158... schrieb:
> Yeah, really?
> All I can find concerning multiple contents in one rule is the following
> statement:
> 
> Note that multiple content rules can be specified in one rule. This allows
> rules to be tailored for less false positives.
> 
> I can't find any further information, can you?

Take a look at the section 3.8.4 Optimizing rules as well as the "new"
2.3.0 manual which you can find in the tgz. Search for "content"...

Regards,
Edin

> 
> Thanks so far
> 
> Peter
> 


-- 
Edin Dizdarevic




More information about the Snort-users mailing list