Re: snort not alerting on rule if IE is used

[Eoin Miller <eoin.miller () trojanedbinaries com>]

On 5/9/2011 1:11 PM, Prashant cd c.d wrote:
> Hi
> I have snort rules to alert for specific host name and URL.
> when I tested I see that snort is not alerting if I use internet 
> explorer 8, but alerting if i use firefox and safari
> after analysis , i found that "Host" field is in bottom of request in 
> case of IE8 , and its on top in other browsers.
> My config file has
>
> preprocessor http_inspect_server:  server default \
>                                    profile all \
>                                    ports { 80 8080 8001 } \
>                                    flow_depth -1 \
>                                    no_alerts
>
>  .it may be possibel that due to large GET header in IE, it is split 
> into multiple pkts.
> I suspect that snort is not scanning all pkts of header
> is it limitation
> should i add anything in my conf file or add anything to http_inspect?
>
> thanks for help in advance
See this:
http://trojanedbinaries.com/blog/?p=217

I don't know if this has been fixed yet, but I know it was reported a 
while ago.

1) What version of Snort are you running?
2) Check out the snort.conf that comes with the VRT rulepack for the 
best way to start your http_inspect configuration.

-- Eoin

-- Eoin

------------------------------------------------------------------------------
WhatsUp Gold - Download Free Network Management Software
The most intuitive, comprehensive, and cost-effective network 
management toolset available today.  Delivers lowest initial 
acquisition cost and overall TCO of any competing solution.
http://p.sf.net/sfu/whatsupgold-sd
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users