Re: Question about content

[Matt Olney <molney () sourcefire com>]

Yep...but I'm feeling uber generous this morning, so I'll give you a tip:

PCRE$

On Tue, Dec 1, 2009 at 8:33 AM, Nigel Houghton <nhoughton () sourcefire com> wrote:
> On Tue, Dec 1, 2009 at 4:11 AM, sofia insat <sofia.insat () yahoo fr> wrote:
> > Hi,
> >
> > I want to detect the last word in the content
> > for exemple if I have this bytes: ....1245643577AAAA
> > how can I verify that it contains "AAAA" at the end without knowing the total size of bytes
> >
> >
> >
> > ------------------------------------------------------------------------------
> > Join us December 9, 2009 for the Red Hat Virtual Experience,
> > a free event focused on virtualization and cloud computing.
> > Attend in-depth sessions from your desk. Your couch. Anywhere.
> > http://p.sf.net/sfu/redhat-sfdev2dev
> > _______________________________________________
> > Snort-sigs mailing list
> > Snort-sigs () lists sourceforge net
> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>
> Again, this looks like a homework assignment. This list is not the
> place for homework questions.
>
> The answers you seek can be found in the Snort manual and the
> associated README files in the Snort tarball. You need to do some work
> and read the documentation.
>
> --
> Nigel Houghton
> Head Mentalist
> SF VRT
> http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/
>
> ------------------------------------------------------------------------------
> Join us December 9, 2009 for the Red Hat Virtual Experience,
> a free event focused on virtualization and cloud computing.
> Attend in-depth sessions from your desk. Your couch. Anywhere.
> http://p.sf.net/sfu/redhat-sfdev2dev
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

------------------------------------------------------------------------------
Join us December 9, 2009 for the Red Hat Virtual Experience,
a free event focused on virtualization and cloud computing. 
Attend in-depth sessions from your desk. Your couch. Anywhere.
http://p.sf.net/sfu/redhat-sfdev2dev
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs