[Bro] Bro signatures

[Robin Sommer]

On Sat, Oct 22, 2011 at 18:45 +0200, you wrote:

> What if I use a combination of those expressions:
> 
> payload /*common.*attack.*/
> payload /*vulnerabilities*/

Both need to match, but independently. I.e, it's ok if
/vulnerabilities/ matches before (or even overlapping with).
/*common.*attack.*/. 

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org