[Oisf-users] Luajit test rules

Victor Julien victor at inliniac.net
Sat Sep 29 10:48:31 UTC 2012

On 09/29/2012 12:43 PM, Chris Wakelin wrote:
> That works! As it happens the "|0D 0A 0D 0A|PK" string doesn't work on
> my pcap which has the HTTP response header (ending 0D0A0D0A) and body
> (starting PK) in different packets. I copied it from the
> emerging-info.rules 2014472/3 which also don't work :-/

Can you share that pcap? Expecting a stream match in that case.

Victor Julien
PGP: http://www.inliniac.net/victorjulien.asc

More information about the Oisf-users mailing list