[Snort-inline-users] rule to replace

[Miguel A. <mar...@gm...>]

Hi, i need to write a rule to replace a character to another.
i have this..

alert tcp any 1863 -> any any (msg:"aviso"); flow:established;
content:"CAL"; depth:4; replace "XX2"; .....

this rule works fine, but, now i need a rule like:

if found "CAL" replace the characters at the position 14 of the packet
by "john"

My problem is to replace on another position, not the characters where
the condition was found.

I hope you can understand my english.
thanks.

Miguel Arrighi