No subject


Thu Nov 23 16:36:19 EST 2017


The easiest way to view distance is

a.{4}.*b

where that maps to:

content: "a"; content: "b"; distance: 4;

Within bounds the number of bytes that will be checked prior.
-- 
Chris Green <cmg at ...1935...>
Chicken's thinkin'




More information about the Snort-users mailing list