On Mon, 2003-03-24 at 13:48, rmkml wrote: > ok, > You view one or two event ? > > because, first session (tcp port 34913) is not view by firestorm, > > and second session (tcp port 34914) is view by firestorm ... > AHA! right you are! Yes, interesting, they have "offset:13" or "offset:14" in the rules but it appears to be at offset 12, I wonder if this is an off-by-one error in the interpretation of the 'offset' modifier. Let me look in to it :) thanks again. -- // Gianni Tedesco (gianni at scaramanga dot co dot uk) lynx --source www.scaramanga.co.uk/gianni-at-ecsc.asc | gpg --import 8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D
Attachment:
signature.asc
Description: This is a digitally signed message part