Snort mailing list archives
Re: Reserved characters in msg:"..."?
From: Martin Roesch <roesch () sourcefire com>
Date: Tue, 17 Feb 2004 15:17:00 -0500
I think colon (:), semicolon (;) and double quote (") are the only ones that need escaping looking through the code.
Just escape them with a '\' if you need to use them in a message. -Marty On Feb 16, 2004, at 12:53 PM, John Sage wrote:
hello world... Are there reserved characters that *cannot* be used within the msg:"..." construct? Seems I remember having problems with dots in the past, but I'm not sure. Any general rules about what can and cannot be used? Can escapes of some sort be used for those that are problematic? (If relevant: snort 2.1.1-RC1 Build 18, Linux 2.4.20..) TIA.. - John -- "Mad cow? You'd be mad too, if someone was trying to eat you." ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616 Sourcefire: Intelligent Security Monitoring roesch () sourcefire com - http://www.sourcefire.com Snort: Open Source Network IDS - http://www.snort.org ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Reserved characters in msg:"..."? John Sage (Feb 16)
- Re: Reserved characters in msg:"..."? Martin Roesch (Feb 17)
- New snort rule for WORM_NETSKY.B yet PLEASE??? Snortty (Feb 18)
- Re: New snort rule for WORM_NETSKY.B yet PLEASE??? Matt Kettler (Feb 18)
- New snort rule for WORM_NETSKY.B yet PLEASE??? Snortty (Feb 18)
- <Possible follow-ups>
- RE: Reserved characters in msg:"..."? CGhercoias (Feb 16)
- Re: Reserved characters in msg:"..."? Martin Roesch (Feb 17)