Re: Two content variables

[Erek Adams <erek () theadamsfamily net>]

On Fri, 5 Apr 2002, Kevin L Pawloski wrote:

> Is there a way to have two content variables for a rule in snort? I need
> an alert to look for one series of characters but also disqualify the
> rule if another specified character set is in the payload.

Just to clarify what you're asking about, you want something like:

        If content is "xyz" then
                If content is "ABC" then ignore
                else alert;
Right?

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users