Snort mailing list archives
Re: Two content variables
From: Kevin L Pawloski <kpawloski () juno com>
Date: Fri, 5 Apr 2002 17:09:50 -0800
Yeah exactly. On Fri, 5 Apr 2002 16:56:37 -0800 (PST) Erek Adams <erek () theadamsfamily net> writes:
On Fri, 5 Apr 2002, Kevin L Pawloski wrote:Is there a way to have two content variables for a rule in snort?I needan alert to look for one series of characters but also disqualifytherule if another specified character set is in the payload.Just to clarify what you're asking about, you want something like: If content is "xyz" then If content is "ABC" then ignore else alert; Right? ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net
________________________________________________________________ GET INTERNET ACCESS FROM JUNO! Juno offers FREE or PREMIUM Internet access for less! Join Juno today! For your FREE software, visit: http://dl.www.juno.com/get/web/. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Two content variables Kevin L Pawloski (Apr 05)
- Re: Two content variables Erek Adams (Apr 05)
- <Possible follow-ups>
- Re: Two content variables Kevin L Pawloski (Apr 05)
- Re: Two content variables Erek Adams (Apr 05)