Snort mailing list archives
Quick question about byte_test
From: Jeffrey Stebelton <jstebelton () netjets com>
Date: Tue, 12 Feb 2013 19:49:30 +0000
When byte_test follows byte_extract, does a relative offset start after the number of bytes put into the variable in byte_extract or a previous content match before the byte_extract? And if it's the latter, then there would have to be at least one content match before the byte_extract? Jeff *** *** *** This message contains information which may be confidential and privileged. Unless you are the addressee (or authorized to receive for the addressee), you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received the message in error, please advise the sender by reply e-mail and delete the message.
------------------------------------------------------------------------------ Free Next-Gen Firewall Hardware Offer Buy your Sophos next-gen firewall before the end March 2013 and get the hardware for free! Learn more. http://p.sf.net/sfu/sophos-d2d-feb
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Quick question about byte_test Jeffrey Stebelton (Feb 12)
- Re: Quick question about byte_test Nathan Benson (Feb 14)