Re: Rule creation: content keyword

[Frank Knobbe <frank () knobbe us>]

On Sun, 2005-02-06 at 20:13 +0100, mosquitooth () gmx net wrote:
> just one question: If I specify more than one "content:"[x]"" keyword in a
> snort rule - are these content patterns relative towards each other? If so,
> where does a new search for e.g. the second pattern start? At the last byte
> of the last (e.g. first) successful match?


It's all explained in the Snort Manual at:
http://www.snort.org/docs/snort_manual/


Specifically this section:
http://www.snort.org/docs/snort_manual/node20.html


Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part