next up previous contents
Next: http_stat_code Up: http_raw_uri Previous: Format   Contents

Examples

This rule constrains the search for the pattern "EFG" to the UNNORMALIZED URI.

    alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_raw_uri;)

Note:  

The http_raw_uri modifier is not allowed to be used with the rawbytes, http_uri or fast_pattern modifiers for the same content.



Eugene Misnik 2013-05-08