[Oisf-users] http_server_body could not point to the beginning of the server response body

[苏 哲]

Hi,
I found  when I wrote rules like:
content:"xyz"; nocase; http_server_body; offset:0;

but actually , "offset:0" is invalid, useless. cause, it didn't detect from beginning of the server response body.

I want to know how should I do if I wanna detect from beginning of the server response body?

thank
SuZhe
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190123/5703111e/attachment.html>