[Oisf-users] Luajit test rules

[Victor Julien]

On 09/29/2012 12:43 PM, Chris Wakelin wrote:
> That works! As it happens the "|0D 0A 0D 0A|PK" string doesn't work on
> my pcap which has the HTTP response header (ending 0D0A0D0A) and body
> (starting PK) in different packets. I copied it from the
> emerging-info.rules 2014472/3 which also don't work :-/

Can you share that pcap? Expecting a stream match in that case.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------