[Oisf-devel] suricata: byte_jump and content after not supported

[rmkml]

thx for reply will,
Im opened ticket #163 for this.
Regards
Rmkml


On Thu, 20 May 2010, Will Metcalf wrote:

> This appears to be a bug on our end. This should be supported. Please go
> ahead and open a ticket, otherwise I can.
>
> Regards,
>
> Will
>> On Thu, 2010-05-20 at 14:59 +0200, rmkml wrote:
>> Hi,
>> Before opening a ticket, I prefer speak on this.
>> Ok I have an error with this signature:
>>   [22914] 20/5/2010 -- 17:08:17 - (detect-within.c:177) <Error> (DetectWithinSetup) -- [ERRCODE: SC_ERR_WITHIN_MISSING_CONTENT(101)] - within needs two preceeding content or uricontent options
>>   [22914] 20/5/2010 -- 17:08:17 - (detect.c:319) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - Error parsing signature
>> "alert tcp any 80 -> any any (msg:"suricata test"; flow:from_server,established; byte_jump:1,2; content:"|00|"; within:1; distance:2;
>>   classtype:attempted-admin; sid:98711212; rev:1;)" from file ...
>>
>> This test work on snort.
>> Anyone have a comment please?
>> or maybe a ticket is already opened?
>> Regards
>> Rmkml
>> _______________________________________________
>> Oisf-devel mailing list
>> Oisf-devel at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>
>