Re: [Snort-sigs] Rule 2480 : byte_jump doesn't make sense.

On Tue, May 10, 2005 at 10:10:10AM +1000, Erik de Castro Lopo wrote:
> It seems to me that relative and from_beginning are mutually 
> exclusive. Is that right?

No.

You read the values relative from the current position.  You jump from
the beginning of the packet.

In the example you gave:

> byte_jump:2,-10,relative,from_beginning;

The value we are reading is an offset from the beginning of the
request.  It is in a specific location, so we get to it via other
means, and then read that value, then jump that many bytes forward
from the begining of the request.

The interesting part to note is that in SMB, when the offset is the
offset from the beginning of the request, its really the beginning of
the SMB request, after the 4 bytes of netbios header.

Brian


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs