Snort mailing list archives
Re: [Emerging-Sigs] what s the real difference here?
From: Joel Esler <jesler () sourcefire com>
Date: Tue, 13 Jul 2010 19:10:21 -0400
On Jul 13, 2010, at 6:58 PM, waldo kitty wrote:
On 7/13/2010 18:40, Joel Esler wrote:CC'ing Snort-Sigs list: Copy and paste out of the manual for http_uri: "Using a content rule option followed by a http uri modifier is the same as using a uricontent by itself."that's what i thought... so... if i may be so bold... why the change in format? which is better? is one preferred over the other? which one?
Not sure of the reasoning behind it. Maybe a Devel or VRT can chime in on that one. ------------------------------------------------------------------------------ This SF.net email is sponsored by Sprint What will you do first with EVO, the first 4G phone? Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
Current thread:
- Re: [Emerging-Sigs] what's the real difference here? Joel Esler (Jul 13)
- Message not available
- Re: [Emerging-Sigs] what s the real difference here? Joel Esler (Jul 13)
- Re: [Emerging-Sigs] what s the real difference here? waldo kitty (Jul 14)
- Re: [Emerging-Sigs] what s the real difference here? Joel Esler (Jul 14)
- Re: [Emerging-Sigs] what s the real difference here? Matt Watchinski (Jul 14)
- Re: [Emerging-Sigs] what s the real difference here? Joel Esler (Jul 13)
- Message not available