Re: Rules-metadata option

[Joel Esler <jesler () sourcefire com>]

On Oct 1, 2012, at 12:31 PM, Alex Adamos <alexthakidadam () hotmail com> wrote:

> what is exactly the metadata option at the preprocessor rules? for example, 
>
> alert ( msg: "FRAG3_IPOPTIONS"; sid: 1; gid: 123; rev: 1; metadata: rule-type preproc ; 
> classtype:protocol-command-decode; )

It means that this rule is actually a preprocessor rule.

> when does this rule get fired? the pattern matcher will match what exactly??? i mean that this rule
>
> # alert tcp $ any any -> any any (msg:"bla"; content:"!@|23|"; sid:1; rev:9;)
>
>
> gets fired when there is a content "!@|23|", but what about the preproc rule??

There are no content matches here, this allows you to turn on or off the alerting (or blocking) of a preprocessor rule.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

------------------------------------------------------------------------------
Got visibility?
Most devs has no idea what their production app looks like.
Find out how fast your code is with AppDynamics Lite.
http://ad.doubleclick.net/clk;262219671;13503038;y?
http://info.appdynamics.com/FreeJavaPerformanceDownload.html

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!