Snort mailing list archives
http_inpect appears to mangle contents
From: "Giles, David C." <gilesdc () ornl gov>
Date: Thu, 14 Oct 2004 17:02:01 -0400
I am new to snort and am setting up snort 2.2.0 on a FreeBSD 4.8 system. I used the "ports" build process to build snort and pcre 5.0. I have one simple rule: redalert tcp any any -> any any (content:"my snort test"; nocase;) In snort.conf I have the default http_inpect statements: preprocessor http_inspect: global \ iis_unicode_map /home/snort/snort/conf/unicode.map 1252 preprocessor http_inspect_server: server default \ profile all ports { 80 8080 8180 } oversize_dir_length 500 I start snort with: /usr/local/bin/snort -c $CONFIG_DIR/snort.conf -u snort -I sk0 -l /tmp2/snort-logs -k none -z If I comment out the above http_inspect lines in snort.conf then snort detects my test page otherwise it does not. The test server is an Apache 2.0.45 server and the test page is: <html><body> A page to trigger a snort alarm<br> This is a flat page with "My SnORt test" for testing snort. </body></html> Any assistance would be appreciated. Thanks, David Giles ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- http_inpect appears to mangle contents Giles, David C. (Oct 15)
- Re: http_inpect appears to mangle contents Andreas Östling (Oct 15)
- <Possible follow-ups>
- http_inpect appears to mangle contents Giles, David C. (Oct 21)