[Snort-users] Snort Manual - 3.5.21 urilen

Eoin Miller eoin.miller at ...14586...
Wed Dec 28 22:24:32 EST 2011


---SNIP---
The following example will match URIs that are greater than 5 bytes and
less than 10 bytes:

urilen:5<>10;
---SNIP---


Seems weird that the operators work like:

urilen:min<>max

Seems like it should be the other way if you think of the less than and
greater than operators? More like:

urilen:max<>min;

Makes my brain think maxNumber-lessThan && greaterThan-minNumber;

urilen:10<>5;

-- Eoin




More information about the Snort-users mailing list