Forum Discussion
Matt_Williamson
Nimbostratus
NimbostratusiRule to persist on tcp_content
Hi all, I'm trying to write a rule that will search the first 2500 bytes of tcp_content for the "USERNAME=" string and then persist on the next 7 characters after that. Here is my original attempt. ...
vinny_murphy_96Nimbostratus
NimbostratusHi,
Could you explain the 9, t, and the ne in your script it seems to work fine but i dont really understand it.
Cheers.
