okay, so I'm in fort myers florida. at the airport in my rental car, in the middle of the highway. blogging. Why? Apparently Dick Cheney is in town and they have blocked off the road while we are waiting for his convoy. I don't mind. it's actually kinda cool. I just saw it a minute ago, cop cars ambulances.. Prolly about 20 or so cars. but that's not what is funny. (first off, everyone is out in the street) but there is a lady doing yoga on the roof of her suv. that's funny. I would have took a picture...... but she got down.
Without going off the deep-end here and discussing every single Snort rule keyword, I just wanted to touch on a few modifiers that people sometimes misunderstand. They aren't difficult, and hopefully after this explanation and a few examples, I can clear some of the air around these five modifiers.
The five modifiers that I am talking about are
OffsetDepthDistanceWithinnocaseThese five modifiers are not keywords of themselves, but rather they apply as modifiers to another keyword. That keyword is "content". The content keyword is one of the easiest pieces of the Snort rules language as all it does is look for a particular string. So for instance if I wanted to look for the word "joel" within a packet. A simple:
content:"joel";Would allow me to do that. The interesting part comes into play when you want to specify where inside of a particular packet you want the string "joel" to be looked for. If you are running just a plain content ma…
The five modifiers that I am talking about are
OffsetDepthDistanceWithinnocaseThese five modifiers are not keywords of themselves, but rather they apply as modifiers to another keyword. That keyword is "content". The content keyword is one of the easiest pieces of the Snort rules language as all it does is look for a particular string. So for instance if I wanted to look for the word "joel" within a packet. A simple:
content:"joel";Would allow me to do that. The interesting part comes into play when you want to specify where inside of a particular packet you want the string "joel" to be looked for. If you are running just a plain content ma…
Comments