[Oisf-users] 答复: http_server_body could not point to the beginning of the server response body

[Su Zhe]

Hi
is there any one know how to solve this problem?

thank you!

Regards
SuZhe
________________________________
发件人: Oisf-users <oisf-users-bounces at lists.openinfosecfoundation.org> 代表 苏 哲 <suzhe_ffgg at outlook.com>
发送时间: 2019年1月23日 6:18
收件人: oisf-users at lists.openinfosecfoundation.org
主题: [Oisf-users] http_server_body could not point to the beginning of the server response body

Hi,
I found  when I wrote rules like:
content:"xyz"; nocase; http_server_body; offset:0;

but actually , "offset:0" is invalid, useless. cause, it didn't detect from beginning of the server response body.

I want to know how should I do if I wanna detect from beginning of the server response body?

thank
SuZhe
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190128/45e5b924/attachment.html>