RE: [Snort-inline-users] Re: I think that matching on uricontent is broken in 2.1.1

[Rob M. <ro...@ho...>]

> Rob,
> 	Could you give me some guidance on when the uricontent will be working
> again. I was planning on upgrading from 2.0.5 Build 98 to match my other
> snort sensors which are 2.1.1 and the uricontent features heavily in the
> subset of rules I use. Is it planned as an interim release for 2.1.1 or
> are
> you waiting for 2.1.2?

Actually, as I sent that email, I realized that I was not writing what I
meant.  What I should have said is that the replace functionality only
works with the content keyword.  I was having a bad day ;)

I'll have to see if it is the uricontent or the lack of stream reassembly
is affecting the match.

Anyone else having the same problem?

Rob