next up previous contents
Next: detection_filter Up: Post-Detection Rule Options Previous: Format   Contents


The replace keyword is a feature available in inline mode which will cause Snort to replace the prior matching content with the given string. Both the new string and the content it is to replace must have the same length. You can have multiple replacements within a rule, one per content.


Eugene Misnik 2013-05-08