On Wed, Aug 17, 2016 at 07:15:27AM +0000, Ariano-Tim Donda wrote:
> But how to replace the part .{5} ?
> There are 5 bytes which are not equal in any query.I didn't notice this part. And since it's only in a tcp-check, it's not possible to use the bytes converter to apply to certain parts. We'd possibly need a new matching method to support a more complex form (eg: like the u32 match that iproute/tc/netfilter support). Willy
