Example

Snort - the de facto standard for intrusion detection/prevention

the de facto standard in IPS

Search Site

Search Rules

Account

email
password

not registered?

user preferences

Next: Changing content behavior Up: content Previous: Format Contents

Example

**Figure:** Mixed Binary Bytecode and Text in a 'content' keyword
$\begin{figure}\begin{verbatim}alert tcp any any -> any 139 (content:''\vert 5c... ...t0\vert I\vert0\vert P\vert0\vert E\vert0 5c\vert'';)\end{verbatim} \end{figure}$

**Figure:** Negation Example
$\begin{figure}\begin{verbatim}alert tcp any any -> any 80 (content:!''GET'';)\end{verbatim} \end{figure}$

Note: A ! modifier negates the results of the entire content search, modifiers included. For example, if using content:!"A"; within:50; and there are only 5 bytes of payload and there is no "A" in those 5 bytes, the result will return a match. If there must be 50 bytes for a valid match, use isdataat as a pre-cursor to the content.

Steven Sturges 2007-10-04