Re: Rule creation: content keyword

[Edin Dizdarevic <Edin.Dizdarevic () interActive-Systems de>]

mosquitooth () gmx net schrieb:
> Yeah, really?
> All I can find concerning multiple contents in one rule is the following
> statement:
>
> Note that multiple content rules can be specified in one rule. This allows
> rules to be tailored for less false positives.
>
> I can't find any further information, can you?

Take a look at the section 3.8.4 Optimizing rules as well as the "new"
2.3.0 manual which you can find in the tgz. Search for "content"...

Regards,
Edin

> Thanks so far
>
> Peter


--
Edin Dizdarevic


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users