From 23fc39ad8482c598b4180d62e848d79457c72da9 Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Fri, 6 Jul 2012 16:14:17 +0530 Subject: [PATCH] bug #496 - don't warn about offset/depth for packet sigs --- src/detect-engine-analyzer.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index 3a9f343..d802cbc 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -514,7 +514,7 @@ void EngineAnalysisRules(Signature *s, char *line) && (rule_pcre > 0 || rule_pcre_http > 0)*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule uses pcre with only a http_method content; possible performance issue.\n"); } - if (rule_content_offset_depth > 0) { + if (rule_content_offset_depth > 0 && s->flags & SIG_FLAG_REQUIRE_STREAM) { fprintf(rule_engine_analysis_FD, " Warning: Rule has depth" "/offset with raw content keywords. Please note the " "offset/depth will be checked against both packet " -- 1.7.1