Re: query for snort signature writing using if condition

["Al Lewis \(allewi\) via Snort-users" <snort-users () lists snort org>]

Can you give an example of what you are trying to do?

What condition are you trying to use “if” on?


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
SOURCEfire, Inc. now part of Cisco
Email: allewi () cisco com<mailto:allewi () cisco com>
From: Snort-users <snort-users-bounces () lists snort org> on behalf of Ngnr Pu via Snort-users <snort-users () lists 
snort org>
Reply-To: Ngnr Pu <ngnrpu () gmail com>
Date: Sunday, February 11, 2018 at 6:47 AM
To: "snort-users () lists snort org" <snort-users () lists snort org>
Subject: [Snort-users] query for snort signature writing using if condition

i want to write a rule based on if condition. Any solution or hint please?

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette