Snort mailing list archives
content question
From: Petre Bandac <petre () kgb ro>
Date: Sun, 29 Sep 2002 11:43:45 +0300
I want to block all dcc sends which contain mp3, avi, mpeg and other large files, allowing the rest am I allowd to use a wildcard in the content rule ? I presume not (haven't tried yet, though). can I concatenate two/more content rules ? my content text looks like this: DCC SEND any_file_name.mp3, and I am interested only in DCC SEND and the extension thanks, petre -- Login: petre Name: Petre Bandac Directory: /home/petre Shell: /bin/bash Office: -, - Home Phone: - On since Sun Sep 29 10:12 (EEST) on tty2 1 hour 21 minutes idle No mail. Plan: none, for the time being :-) ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- content question Petre Bandac (Sep 29)
- Re: content question Martin Roesch (Sep 29)