Re: Rule creation: content keyword

[Matt Kettler <mkettler () evi-inc com>]

At 02:13 PM 2/6/2005, mosquitooth () gmx net wrote:
> just one question: If I specify more than one "content:"[x]"" keyword in a
> snort rule - are these content patterns relative towards each other? If so,
> where does a new search for e.g. the second pattern start? At the last byte
> of the last (e.g. first) successful match?

Yes they are relative to each other.

The search for the second string begins just after the end of the first, 
unless you use the offset keyword to modify the second content, in which 
case that many bytes are skipped prior to starting the search. 



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users