next up previous contents
Next: Non-Payload Detection Quick Reference Up: stream_size Previous: Format   Contents

Example

For example, to look for a session that is less that 6 bytes from the client side, use: 

    alert tcp any any -> any any (stream_size:client,<,6;)


Eugene Misnik 2013-05-08