[Oisf-devel] suricata: byte_jump and content after not supported

rmkml rmkml at free.fr
Thu May 20 12:59:33 UTC 2010


Hi,
Before opening a ticket, I prefer speak on this.
Ok I have an error with this signature:
  [22914] 20/5/2010 -- 17:08:17 - (detect-within.c:177) <Error> (DetectWithinSetup) -- [ERRCODE: SC_ERR_WITHIN_MISSING_CONTENT(101)] - within needs two preceeding content or uricontent options
  [22914] 20/5/2010 -- 17:08:17 - (detect.c:319) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - Error parsing signature 
"alert tcp any 80 -> any any (msg:"suricata test"; flow:from_server,established; byte_jump:1,2; content:"|00|"; within:1; distance:2;
  classtype:attempted-admin; sid:98711212; rev:1;)" from file ...

This test work on snort.
Anyone have a comment please?
or maybe a ticket is already opened?
Regards
Rmkml



More information about the Oisf-devel mailing list