content question

[Petre Bandac <petre () kgb ro>]

I want to block all dcc sends which contain mp3, avi, mpeg and other large 
files, allowing the rest

am I allowd to use a wildcard in the content rule ? I presume not (haven't 
tried yet, though). 

can I concatenate two/more content rules ?

my content text looks like this: DCC SEND any_file_name.mp3, and I am 
interested only in DCC SEND and the extension


thanks,

petre



-- 
Login: petre                            Name: Petre Bandac
Directory: /home/petre                  Shell: /bin/bash
Office: -, -                            Home Phone: -
On since Sun Sep 29 10:12 (EEST) on tty2   1 hour 21 minutes idle
No mail.
Plan:

none, for the time being :-)





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users