<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<pre wrap="">Hi Harley,
Please see Bug #1481:
<a class="moz-txt-link-freetext" href="https://redmine.openinfosecfoundation.org/issues/1481">https://redmine.openinfosecfoundation.org/issues/1481</a>
-David Wharton</pre>
<br>
<br>
<div class="moz-cite-prefix">On 08/03/2015 03:16 PM, Harley H wrote:<br>
</div>
<blockquote
cite="mid:CAGRHET82L3uvdc155pWRNbXv=qG1RGNy56-iU67m=NrPPUVXSg@mail.gmail.com"
type="cite">
<pre wrap="">Hello,
Is it possible to remove leading spaces in flowbit names? I came across a
scenario like the following:
alert tcp any any <> any any (msg: "bad stuff 1"; content: "bad"; flowbits:
set,badstuff;)
alert tcp any any <> any any (msg: "bad stuff 2 "; content: "stuff";
flowbits: isset, badstuff;)
"bad stuff 2" failed to alert because there was a space in between the
flowbit name and the comma. I realize it's general practice not to put
spaces there but am hoping it's an easy enough fix to implement.
Thanks,
Harley
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Suricata IDS Devel mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Participate: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/participate/">http://suricata-ids.org/participate/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a>
Redmine: <a class="moz-txt-link-freetext" href="https://redmine.openinfosecfoundation.org/">https://redmine.openinfosecfoundation.org/</a>
Developer Training in Copenhagen Sept 14-18: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/training/">http://suricata-ids.org/training/</a></pre>
</blockquote>
<br>
</body>
</html>