Hi,
content:!“|C0 A8 01 01|”; # This works
content:!$DHCP_SERVERS; # This fails to parse
I’m trying to detect rogue DHCP servers, and want to detect option54 values instead of src or dst ip addresses
Any suggestion ?
Is this because of a typing issue (hex / string …)
Or because it is not allowed at all in the content and worst with negate ?
I’m using an old version 6.0.2
Regards