Without going off the deep-end here and discussing every single Snort rule keyword, I just wanted to touch on a few modifiers that people sometimes misunderstand. They aren't difficult, and hopefully after this explanation and a few examples, I can clear some of the air around these five modifiers.
The five modifiers that I am talking about are
OffsetDepthDistanceWithinnocaseThese five modifiers are not keywords of themselves, but rather they apply as modifiers to another keyword. That keyword is "content". The content keyword is one of the easiest pieces of the Snort rules language as all it does is look for a particular string. So for instance if I wanted to look for the word "joel" within a packet. A simple:
content:"joel";Would allow me to do that. The interesting part comes into play when you want to specify where inside of a particular packet you want the string "joel" to be looked for. If you are running just a plain content ma…
Comments
Damned Lawyers