Question about content

[sofia insat <sofia.insat () yahoo fr>]

Hi,

I want to detect the last word in the content
for exemple if I have this bytes: ....1245643577AAAA
how can I verify that it contains "AAAA" at the end without knowing the total size of bytes




------------------------------------------------------------------------------
Join us December 9, 2009 for the Red Hat Virtual Experience,
a free event focused on virtualization and cloud computing. 
Attend in-depth sessions from your desk. Your couch. Anywhere.
http://p.sf.net/sfu/redhat-sfdev2dev

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs