Re: Trouble with home-made rule

[Dragos Ruiu <dr () kyx net>]

On Monday 18 June 2001 06:26, Brian Caswell wrote:
> Dragos Ruiu wrote:
> > Your problem is with the backslash before the quote....
> > \" is how you escape a quote inside the content string
> > so it looks like an unterminated string to the parser.
> >
> > try:
> >
> > "C:\\"
> >
> > and remember to add another rule for lowercase:
> >
> > "c:\\"
>
> Or just use the keyword nocase.

Duh.... it's late... I need sleep.

thanks,
--dr

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users