Quick question about byte_test

[Jeffrey Stebelton <jstebelton () netjets com>]

When byte_test follows byte_extract, does a relative offset start after the number of bytes put into the variable in 
byte_extract or a previous content match before the byte_extract? And if it's the latter, then there would have to be 
at least one content match before the byte_extract?

Jeff


*** *** ***
This message contains information which may be confidential and privileged. Unless you are the addressee (or authorized 
to receive for the addressee), you may not use, copy or disclose to anyone the message or any information contained in 
the message. If you have received the message in error,  please advise the sender by reply e-mail and delete the 
message.

------------------------------------------------------------------------------
Free Next-Gen Firewall Hardware Offer
Buy your Sophos next-gen firewall before the end March 2013 
and get the hardware for free! Learn more.
http://p.sf.net/sfu/sophos-d2d-feb

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!