Writing rules

[Patrice.Arnal () alcatel fr]

Hello

Using Snort 1.6 to 1.9 , the following rules triggered fine :

alert tcp any any -> any 80 (msg:"INFO WEB-MISC Domino da50.nsf 
access";flags: A+;content:"/da50.nsf";)
alert tcp any any -> any 80 (msg:"WEB-MISC Lotus Notes da50.nsf access"; 
flow:to_server,established; uricontent:"/da50.nsf"; 
classtype:web-application-attack; sid:2065; rev:1;)

Since Snort2.0 they no more trigger 

Help


-------------------------------------------------------
This SF.net email is sponsored by: eBay
Get office equipment for less on eBay!
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users