Question

["Corrado Federici" <cfederici () carabinieri it>]

Hi
It seems to me that the keyword 'nocase' is uneffective when present in rule
where also 'content-list' is present. E.G. A line like this:

log tcp any any -> any 25 (content-list: "content.txt "; nocase;)

only logs if file content.txt contains a word that exactly matches the one
sniffed by Snort.
Can anyone confirm/deny?

Thanks .

Corrado Federici
Snort beginner.







-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users