TCP header reserved bits

[Y M <snort () outlook com>]

I was wondering if there is a content modifier or some way to check whether the low order reserved bits of byte offset 
12 in the TCP header is set. There is nothing I could find about this in the documentation. I also checked gid:129 
rules and couldn't infer that the check/detection is available.

Any pointers or help is welcome.

Thanks.
YM

------------------------------------------------------------------------------

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!