[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-sigs
Subject:    Re: [Snort-sigs] [Emerging-Sigs] what's the real difference here?
From:       Joel Esler <jesler () sourcefire ! com>
Date:       2010-07-13 22:40:45
Message-ID: 2D9DA9D1-1540-46C0-BE48-467CDE8F2BDC () sourcefire ! com
[Download RAW message or body]

CC'ing Snort-Sigs list:

Copy and paste out of the manual for http_uri:

"Using a content rule option followed by a http uri modifier is the same as using a \
uricontent by itself."

Joel

On Jul 13, 2010, at 5:59 PM, waldo kitty wrote:

> 
> what's the real difference between these two formats?
> 
> uricontent:"/register";
> 
> content:"/register"; http_uri;
> 
> 
> is http_uri taking the place of uricontent?
> 
> does http_uri cause the rule to trigger or break out sooner?
> 

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs


[prev in list] [next in list] [prev in thread] [next in thread]