Tag Info

New answers tagged


Specifically, why do they contain more than one "content" field ? If you have multiple content fields, snort tries to match the first content field followed by the seconds field, etc in a recursive way. I took a modified example from here: alert ip any any -> any any (content:"a"; content:"b";) This rule would look for a, once that matched it then ...


Since you mentioned home network, I'm going to bring up a couple of points that may be unique to them. First, there's the use of dumb switches. Quite often, home customer premises equipment will use dumb unmanaged switches with no support for spanning tree. Internally, this might be a separate switch chip or it might be integrated onto main ...

Top 50 recent answers are included