Content "c:"

["Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>]

I'm trying to create a rule that searches for content of "c:" in packets.
But Snort complains that a closing quote is needed. In a prior posting I had
asked about "c:\" and someone mentioned the backslash was a problem. Even
without the backslash this still fails. Ths is the latest test rule I tried:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Outgoing c:"; content:
"c:"; nocase;)

Snort complains that content needs an ending quote. Apparently the colon
after the "c" is what is messing this up. Does anyone know how to make a
content rule with "c:" or any drive letter as the content?


Thanks,
Paul


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users