RE: [Snort-users] Reserved characters in msg:"..."?

At least one that I know of is the ":" (colon) which must be escaped
something like "192.168.100.10\:12345" for example.

-----Original Message-----
From: John Sage [mailto:jsage@finchhaven.com]=20
Sent: Monday, February 16, 2004 12:54 PM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Reserved characters in msg:"..."?


hello world...


Are there reserved characters that *cannot* be used within the
msg:"..." construct?

Seems I remember having problems with dots in the past, but I'm not
sure.

Any general rules about what can and cannot be used?

Can escapes of some sort be used for those that are problematic?

(If relevant: snort 2.1.1-RC1 Build 18, Linux 2.4.20..)

TIA..


- John
--=20
"Mad cow? You'd be mad too, if someone was trying to eat you."


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=3D1356&al...438&op=3Dclick
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...=3Dsnort-users


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users