> Use a 'full' not 'rawbody' rule. I do not need to parse the header.
>Why are you doing a "tflags __B_PLL multiple maxhits=1" ? >If you have "maxhits=1" what's the point of "multiple" at all? To limit the number of possible matches to a single one.
> Use a 'full' not 'rawbody' rule. I do not need to parse the header.
>Why are you doing a "tflags __B_PLL multiple maxhits=1" ? >If you have "maxhits=1" what's the point of "multiple" at all? To limit the number of possible matches to a single one.