Re: [Snort-users] Reserved characters in msg:"..."?

I think colon (:), semicolon (;) and double quote (") are the only ones
that need escaping looking through the code.

Just escape them with a '\' if you need to use them in a message.

-Marty

On Feb 16, 2004, at 12:53 PM, John Sage wrote:

> hello world...
>
>
> Are there reserved characters that *cannot* be used within the
> msg:"..." construct?
>
> Seems I remember having problems with dots in the past, but I'm not
> sure.
>
> Any general rules about what can and cannot be used?
>
> Can escapes of some sort be used for those that are problematic?
>
> (If relevant: snort 2.1.1-RC1 Build 18, Linux 2.4.20..)
>
> TIA..
>
>
> - John
> --
> "Mad cow? You'd be mad too, if someone was trying to eat you."
>
>
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users
>
>
--
Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616
Sourcefire: Intelligent Security Monitoring
roesch@sourcefire.com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users