For Network IPS appliances, use these supported content specific keywords as modifiers for OpenSignatures.
Use this keyword | To do this action |
---|---|
Depth | Specify how far into a packet to search for
the specified pattern. For example, a 'depth' of 10 would look for
the specified pattern in only the first 10 bytes of the payload. Syntax: depth: <number>;
Example: alert tcp any any -> any
any (msg:"""Search for the depth of payload of google""";content:"""|74
69 6f 6e|""";depth:10;sid:1000;)
|
Offset | Specify where to start searching for a pattern
within a packet. An 'offset' of 10 would start looking for the specified
pattern after the first 10 bytes of the payload. Syntax: offset: <number>;
Example: alert tcp any any -> any
any (msg:"""offset in payload of google""";content:"""google""";offset:20;sid:1000;)
|
Distance | Specify how far into a packet to ignore information
before it starts to search for the specified pattern relative to the
end of the previous pattern match. Much like 'depth', only relative
to the end of the last pattern match instead of the beginning of the
packet. Syntax: distance: <byte
count>;
Example: alert
tcp any any -> any any (msg:"""distance specified between content
when accessing google""";content:"""google""";content:"""Content-Encoding""";distance:150;sid:1000;)
|
Within | Ensure that at most <n> bytes are between
pattern matches by using the content. Use this keyword with the 'distance'
modifier. Syntax: within: <byte
count>;
Example: alert
tcp any any -> any any (msg:"""Search for the string in payload""";content:"""google""";content:"""|43
6f 6e 74 65 6e|""";distance:64;within:30;sid:1000;)
|
Nocase | Look for a specific pattern, ignoring case. Syntax: nocase;
Example: alert tcp any any -> any
any (msg:"""Alert when access google""";content:"""google""";nocase;sid:1000;)
|