Re: [Snort-sigs] Rule 2480 : byte_jump doesn't make sense.

On Tue, 10 May 2005 10:22:33 -0400
Brian <bmc@snort.org> wrote:

> On Tue, May 10, 2005 at 10:10:10AM +1000, Erik de Castro Lopo wrote:
> > It seems to me that relative and from_beginning are mutually 
> > exclusive. Is that right?
>
> No.
>
> You read the values relative from the current position.  You jump from
> the beginning of the packet.

OK, that makes a lot more sense.

Now that I know how it works I can go back and read the documentation
and unfortunately IMO the documentation remains ambiguous.

Maybe it could be changed as follows:

    relative :
        Read the bytes from an offset relative to last pattern match

    from_beginning :
        The jump is from the beginning of the packet rather than the
        current location.

I hope this helps.

Cheers,
Erik
-- 
-------------------------------------------------------
[N] Erik de Castro Lopo, Senior Computer Engineer
[E] erik.de.castro.lopo@sensorynetworks.com
[W] http://www.sensorynetworks.com
[T] +61 2 83022726
[F] +61 2 94750316
[A] L6/140 William St, East Sydney NSW 2011, Australia
-------------------------------------------------------
A good debugger is no substitute for a good test suite.


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs