Re: Escaping "content" characters

[Brian <bmc () snort org>]

On Fri, Nov 15, 2002 at 06:08:11PM -0500, Gary Flynn wrote:
> I'm trying to get a rule working that detects content having
> backslashes following by double quotes. \"

If you get stuck in the future, you can always cheat.

content:"|5C22|";

-brian


-------------------------------------------------------
This sf.net email is sponsored by: To learn the basics of securing 
your web site with SSL, click here to get a FREE TRIAL of a Thawte 
Server Certificate: http://www.gothawte.com/rd524.html
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users