https://home.regit.org/tags/vim/ Recent content in Vim on To Linux and beyond ! Hugo fr Mon, 27 Jun 2011 06:31:31 +0000 https://home.regit.org/2011/06/playing-a-bit-with-vim-macros/ Mon, 27 Jun 2011 06:31:31 +0000 https://home.regit.org/2011/06/playing-a-bit-with-vim-macros/ <p>During one of my recent coding, I had to modify a signature file for suricata. The file was looking like this:</p> <pre>alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 unknown code"; decode-event:icmpv4.unknown_code; sid:2200024; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 truncated packet"; decode-event:icmpv4.ipv4_trunc_pkt; sid:2200025; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 unknown version"; decode-event:icmpv4.ipv4_unknown_ver; sid:2200026; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 packet too small"; decode-event:icmpv6.pkt_too_small; sid:2200027; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 unknown type"; decode-event:icmpv6.unknown_type; sid:2200028; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 unknown code"; decode-event:icmpv6.unknown_code; sid:2200029; rev:1;)</pre> <p>The modification was to decrease the number behind &lt;em&lt;sid</em> by 24 for each signatures.</p>