Rule not working

[simonkc () netsol co in]

I am trying to write the below rule that will detect visits to "rediff.com"
site. But Snort does not seem to detect it.
Anything wrong with what i am doing??

btw. the snort.conf file does have the below line
preprocessor http_decode: 80 unicode iis_alt_unicode double_encode
iis_flip_slash full_whitespace

alert tcp any any -> any any (msg:"Somebody visiting Rediff.com site";
uriconten
t:"rediff.com";
reference:url,www.cisco.com/warp/public/707/cisco-sn-20040326-ex
ploits.shtml; classtype:attempted-dos; sid:999999; rev:2;)

Ignore the "reference", the classtype, sid and rev in the above rule.


Thanks and Regards   

Simon



-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to 
deliver higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg.php?From=osdnemail3
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users