Snort mailing list archives
Content Usage
From: "Steve Johnson" <stevejohnson46 () comcast net>
Date: Wed, 24 Mar 2004 17:13:22 -0800
Hi, Does using the "content" keyword without any attributes like depth means search for the string in the total assembled payload or search for the content in the unassembled first packet payload ? If the content is to be searched in the total assembled payload, for the sake of efficiency is there a recommended size of the assembled packet to check it in ? ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Content Usage Steve Johnson (Mar 24)
- <Possible follow-ups>
- Content Usage Steve Johnson (Mar 24)
- Re: Content Usage Rodrigo B. Ramos (Mar 25)