Re: Writing rules

[Matt Kettler <mkettler () evi-inc com>]

At 10:14 AM 6/2/2003 +0200, Patrice.Arnal () alcatel fr wrote:
> Hello
>
> Using Snort 1.6 to 1.9 , the following rules triggered fine :
>
> alert tcp any any -> any 80 (msg:"INFO WEB-MISC Domino da50.nsf
> access";flags: A+;content:"/da50.nsf";)
> alert tcp any any -> any 80 (msg:"WEB-MISC Lotus Notes da50.nsf access";
> flow:to_server,established; uricontent:"/da50.nsf";
> classtype:web-application-attack; sid:2065; rev:1;)
>
> Since Snort2.0 they no more trigger

The first rule works flawlessly for me. Are you sure your test is being 
done properly?

I added your rule to my local.rules, restarted snort and loaded 
http://www.google.com/da50.nsf up in mozilla. It triggered this (several 
fields are gratuitously censored, but aren't particularly relevant):

[**] [1:0:0] INFO WEB-MISC Domino da50.nsf access [**]
[Priority: 0]
06/02-xx:xx:xx.xxxx 10.xxx.xxx.xxx:xxxx -> 216.239.51.99:80
TCP TTL:xx TOS:0x0 ID:XXXXX IpLen:20 DgmLen:569 DF
***AP*** Seq: 0xXXXXXXXX  Ack: 0xXXXXXXXX  Win: 0xXXXX  TcpLen: 20





-------------------------------------------------------
This SF.net email is sponsored by: eBay
Get office equipment for less on eBay!
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users