<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <pre wrap="">Hi Harley,

Please see Bug #1481:

<a class="moz-txt-link-freetext" href="https://redmine.openinfosecfoundation.org/issues/1481">https://redmine.openinfosecfoundation.org/issues/1481</a>

-David Wharton</pre>
    <br>
    <br>
    <div class="moz-cite-prefix">On 08/03/2015 03:16 PM, Harley H wrote:<br>
    </div>
    <blockquote
cite="mid:CAGRHET82L3uvdc155pWRNbXv=qG1RGNy56-iU67m=NrPPUVXSg@mail.gmail.com"
      type="cite">
      <pre wrap="">Hello,
 Is it possible to remove leading spaces in flowbit names? I came across a
scenario like the following:

alert tcp any any <> any any (msg: "bad stuff 1"; content: "bad"; flowbits:
set,badstuff;)
alert tcp any any <> any any (msg: "bad stuff 2 "; content: "stuff";
flowbits: isset, badstuff;)

"bad stuff 2" failed to alert because there was a space in between the
flowbit name and the comma. I realize it's general practice not to put
spaces there but am hoping it's an easy enough fix to implement.

Thanks,
  Harley

</pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
Suricata IDS Devel mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Participate: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/participate/">http://suricata-ids.org/participate/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a>
Redmine: <a class="moz-txt-link-freetext" href="https://redmine.openinfosecfoundation.org/">https://redmine.openinfosecfoundation.org/</a>
Developer Training in Copenhagen Sept 14-18: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/training/">http://suricata-ids.org/training/</a></pre>
    </blockquote>
    <br>
  </body>
</html>