Snort mailing list archives
Rules-metadata option
From: Alex Adamos <alexthakidadam () hotmail com>
Date: Mon, 1 Oct 2012 19:31:23 +0300
what is exactly the metadata option at the preprocessor rules? for example, alert ( msg: "FRAG3_IPOPTIONS"; sid: 1; gid: 123; rev: 1; metadata: rule-type preproc ; classtype:protocol-command-decode; ) when does this rule get fired? the pattern matcher will match what exactly??? i mean that this rule # alert tcp $ any any -> any any (msg:"bla"; content:"!@|23|"; sid:1; rev:9;) gets fired when there is a content "!@|23|", but what about the preproc rule??
------------------------------------------------------------------------------ Got visibility? Most devs has no idea what their production app looks like. Find out how fast your code is with AppDynamics Lite. http://ad.doubleclick.net/clk;262219671;13503038;y? http://info.appdynamics.com/FreeJavaPerformanceDownload.html
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Rules-metadata option Alex Adamos (Oct 01)
- Re: Rules-metadata option Joel Esler (Oct 01)