Snort mailing list archives
Re: snort not alerting on rule if IE is used
From: Eoin Miller <eoin.miller () trojanedbinaries com>
Date: Mon, 09 May 2011 15:33:44 +0000
On 5/9/2011 3:25 PM, Prashant cd c.d wrote:
Hi Eoin/ rmklm Thanks for reply I am running Version 2.9.0.2 IPv6 (Build 92) I prefer to find and update any config file paramters than upgrading to .5 Could you please let me know where I can find VRT rulepack Thanks
you can download the VRT rulesets and configs at this location: http://www.snort.org/snort-rules/ There is a bug in the current snort.conf that is distributed for the registered users that I know of, here is the http_inspect portion of snort.conf that is all fixed: preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535 decompress_depth 65535 preprocessor http_inspect_server: server default \ chunk_length 500000 \ server_flow_depth 0 \ client_flow_depth 0 \ post_depth 65495 \ oversize_dir_length 500 \ max_header_length 750 \ max_headers 100 \ ports { 80 311 591 593 901 1220 1414 1830 2301 2381 2809 3128 3702 5250 7001 7777 7779 8000 8008 8028 8080 8088 8118 8123 8180 8181 8243 8280 8888 9090 9091 9443 9999 11371 } \ non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \ enable_cookie \ extended_response_inspection \ inspect_gzip \ normalize_utf \ unlimited_decompress \ apache_whitespace no \ ascii no \ bare_byte no \ base36 no \ directory no \ double_decode no \ iis_backslash no \ iis_delimiter no \ iis_unicode no \ multi_slash no \ utf_8 no \ u_encode yes \ webroot no -- Eoin ------------------------------------------------------------------------------ WhatsUp Gold - Download Free Network Management Software The most intuitive, comprehensive, and cost-effective network management toolset available today. Delivers lowest initial acquisition cost and overall TCO of any competing solution. http://p.sf.net/sfu/whatsupgold-sd _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort not alerting on rule if IE is used Prashant cd c.d (May 09)
- Re: snort not alerting on rule if IE is used Eoin Miller (May 09)
- Re: snort not alerting on rule if IE is used Prashant cd c.d (May 12)
- Re: snort not alerting on rule if IE is used Eoin Miller (May 09)
- Re: snort not alerting on rule if IE is used Prashant cd c.d (May 12)
- Re: snort not alerting on rule if IE is used Prashant cd c.d (May 12)
- Re: snort not alerting on rule if IE is used Eoin Miller (May 09)