file_data entry in snort manual

[Will Metcalf <william.metcalf () gmail com>]

> From the snort manual (note "This option option" typo)....  Hmm I
think this example is a bit weird, it shows an example that will match
from the beginning of the payload and is no way relative to setting
the inspection pointer at the start of file_data so what is the point
;-)?


"This option matches if there is HTTP response body or SMTP body. This
option option will operate similarly to the
dce stub data option added with DCE/RPC2, in that it simply sets a
reference for other relative rule options ( byte
test, byte jump, pcre) to use. This file data can point to either a
file or a block of data.

Example
alert tcp any any -> any any(msg:"foo at the start of the payload";
file_data; pcre:"/foo/i";)"


Perhaps this should be something like....

alert tcp any 80 -> any any(msg:"foo at the start of http response
body"; file_data; content:"foo"; nocase; within:3;)

Regards,

Will

------------------------------------------------------------------------------
This SF.net email is sponsored by 

Make an app they can't live without
Enter the BlackBerry Developer Challenge
http://p.sf.net/sfu/RIM-dev2dev 
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users