Hi all The following doesn't match.
match start ICMP payload-start offset 0 size 2 string "jo" The following is matched from 14 bytes onwards match start ICMP payload-start offset 0 size 14 string "jo" "jo" is 2 bytes in length and hence I thought putting 2 bytes would be suffice starting from ICMP payload. Even if I consider 8 bytes of ICMP header, how come it requires 14 byes? *start ICMP payload-start *means it should start from the ICMP payload which means 2 bytes is correct right? With regards Kings
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
