next up previous contents
Next: Format Up: Payload Detection Rule Options Previous: Example   Contents


The distance keyword allows the rule writer to specify how far into a packet Snort should ignore before starting to search for the specified pattern relative to the end of the previous pattern match.

This can be thought of as exactly the same thing as offset (See Section 3.5.5), except it is relative to the end of the last pattern match instead of the beginning of the packet.

This keyword allows values from -65535 to 65535.

The value can also be set to a string value referencing a variable extracted by the byte_extract keyword in the same rule.


Eugene Misnik 2013-05-08