[Snort-sigs] Rule 2480 : byte_jump doesn't make sense.

Hi all,

I'm looking at rule 2480 from the netbios rules which contains the 
following byte_jump component:

    byte_jump:2,-10,relative,from_beginning;

> From the docs, relative means:

    Use an offset relative to last pattern match

while from beginning means:

    Skip forward from the beginning of the packet payload instead 
    of from the current position

It seems to me that relative and from_beginning are mutually 
exclusive. Is that right?

Erik
-- 
-------------------------------------------------------
[N] Erik de Castro Lopo, Senior Computer Engineer
[E] erik.de.castro.lopo@sensorynetworks.com
[W] http://www.sensorynetworks.com
[T] +61 2 83022726
[F] +61 2 94750316
[A] L6/140 William St, East Sydney NSW 2011, Australia
-------------------------------------------------------
A good debugger is no substitute for a good test suite.


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs