Snort mailing list archives
Re: Quick rule question
From: Mike Cox <mike.cox52 () gmail com>
Date: Fri, 19 Oct 2012 09:49:39 -0500
content:".htm"; content:"|22|"; distance:0; within:2; pcre:"/\.html?\x22/"; Obviously this is inefficient without other matching criteria .. what and and where are you trying to match on exactly? -Mike Cox On Fri, Oct 19, 2012 at 9:24 AM, James Lay <jlay () slave-tothe-box net> wrote:
Hey all, Quick question...trying to match: .htm" OR .html" my content can be htm and that's fine, but I need to make sure to have the end quote at the end. Thanks all. James ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Quick rule question James Lay (Oct 19)
- Re: Quick rule question Joel Esler (Oct 19)
- Re: Quick rule question James Lay (Oct 19)
- Re: Quick rule question Joel Esler (Oct 19)
- Re: Quick rule question James Lay (Oct 19)
- Re: Quick rule question James Lay (Oct 19)
- Re: Quick rule question Joel Esler (Oct 19)
- Re: Quick rule question Mike Cox (Oct 19)
- Re: Quick rule question Mike Cox (Oct 19)