Forum Discussion
goldberghere
Nimbostratus
NimbostratusPersist Question - noob Q
rule Persist_Universal {
when HTTP_REQUEST {
persist
uie [ findstr [HTTP::uri] "?" 8 3 ]
The issue I'm having with understanding the above is the "3".
So as I understand, i...
santosh_81454Nimbostratus
Nimbostratushere, 3 indicates 3 characters. So, the rule will search for "?" in the URI by skipping the first 8 characters and will look for it in 9th, 10th and 11th character.
When used with "3", the rule searches till it finds the first "3" or till end of the string.
-Santosh.