Snort Forums Archive

Archive Home » Rules » within and distance

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

within and distance

Posted by shimritd on May 04, 2005 03:44:21

Hi,
At snort documentation it says:
distance - The distance keyword is a content modifier that makes sure that atleast N bytes are between pattern matches
within - The within keyword is a content modifier that makes sure that atleast N bytes are between pattern matches
Obviously, there is an error here, it can'b be the same!
do i need to replace "atleast" in the distance definition in "atmost" or maybe in "exactly"?
Regarding both distance and within, where do i start count? at the end of the last match till the start of the new match?

Thanks