[Oisf-devel] Leading spaces in flowbit names

Harley H bobb.harley at gmail.com
Mon Aug 3 19:16:46 UTC 2015

 Is it possible to remove leading spaces in flowbit names? I came across a
scenario like the following:

alert tcp any any <> any any (msg: "bad stuff 1"; content: "bad"; flowbits:
alert tcp any any <> any any (msg: "bad stuff 2 "; content: "stuff";
flowbits: isset, badstuff;)

"bad stuff 2" failed to alert because there was a space in between the
flowbit name and the comma. I realize it's general practice not to put
spaces there but am hoping it's an easy enough fix to implement.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20150803/007bf80e/attachment.html>

More information about the Oisf-devel mailing list