[Snort-users] Rule creation: content keyword

Edin Dizdarevic Edin.Dizdarevic at ...7509...
Sun Feb 6 14:23:41 EST 2005

mosquitooth at ...158... schrieb:
> Yeah, really?
> All I can find concerning multiple contents in one rule is the following
> statement:
> Note that multiple content rules can be specified in one rule. This allows
> rules to be tailored for less false positives.
> I can't find any further information, can you?

Take a look at the section 3.8.4 Optimizing rules as well as the "new"
2.3.0 manual which you can find in the tgz. Search for "content"...


> Thanks so far
> Peter

Edin Dizdarevic

More information about the Snort-users mailing list