Re: Quick rule question

[Joel Esler <jesler () sourcefire com>]

content:".htm"; content:"|22|"; distance:0; within:2; pcre:"/\/html?\x22/";

Something like that?
Is that what you are trying to do?

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

On Oct 19, 2012, at 10:24 AM, James Lay <jlay () slave-tothe-box net> wrote:

> Hey all,
>
> Quick question...trying to match:
>
> .htm"  OR  .html"
>
> my content can be htm and that's fine, but I need to make sure to have 
> the end quote at the end.
>
> Thanks all.
>
> James
>
> ------------------------------------------------------------------------------
> Everyone hates slow websites. So do we.
> Make your web apps faster with AppDynamics
> Download AppDynamics Lite for free today:
> http://p.sf.net/sfu/appdyn_sfd2d_oct
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
>
>
> Please visit http://blog.snort.org for the latest news about Snort!


------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!