Project

General

Profile

Actions

Bug #220

closed

Add support for missing http related snort 2.8.5.x pcre modifiers.

Added by Will Metcalf almost 14 years ago. Updated almost 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

From the Snort manual... We are missing support for the following http related pcre modifiers for 2.8.5.3 support. Seems SF is using at least the 'H' modifier now pretty extensively in VRT rules. Should probably be a task.

H Match normalized HTTP request header (Similar to http header)
M Match normalized HTTP request method (Similar to http method)
C Match normalized HTTP request cookie (Similar to http cookie)


Files

Actions

Also available in: Atom PDF