Snort mailing list archives
Re: Difference between distance and within
From: Erick Mechler <emechler () techometer net>
Date: Tue, 29 Apr 2003 07:29:28 -0700
:: Can somebody provide an example of using distance and :: within with *different* values? I have seen couple of :: examples in the FAQ and manual and they use something :: like distance=4; within=4. I am not completely clear :: on the difference between the two, so an example would :: help. They refer to the same thing, the number of bytes between two 'content' matches. For example, the following rule means "match content of 'foo' and 'bar' separated by exactly 5 bytes." alert tcp any any -> any any (content: "foo"; content: "bar"; distance: 5;) Whereas the next alert means ""match content of 'foo' and 'bar' separated by 5 bytes or less." alert tcp any any -> any any (content: "foo"; content: "bar"; within: 5;) Cheers - Erick ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Difference between distance and within Madhu Joshi (Apr 29)
- Re: Difference between distance and within Erick Mechler (Apr 29)
- Re: Difference between distance and within Brian (Apr 30)