In an older episode (Sunday 26 June 2005 14:23), Loren Wilton wrote: > At a guess, these would be rawbody rules on 3.0+. On 2.6x many times you > can't get to the intervening headers, but if you can, it is usually a 'full' > rule.
Test result: using debian's SA 3.0.4-2, neither rawbody nor body catch it, but a 'full' rule does. I hadn't thought of 'full' thanks. Cheers, wolfgang
