Local alert for website traffic not working

[Ryan Pettigrew <rino655 () gmail com>]

Hi guys,

I have recently been trying to get a local rule working that would alert
when a user accesses a certain webpage. As a test rule, I added the
following line in my local.rules file:

alert tcp any any -> any any (msg:"test eBay rule"; flow:established;
content:"ebay.com"; sid:1000002;rev:1;)

After restarting snort and barnyard and going to the website, I am not
seeing any alerts from snort.
I am certain that other web rules are working because the following local
rule alerts just fine:

alert tcp any any <> any 80 (msg: "Test web activity"; sid:1000001;)

Is there an issue with the way I am writing the ebay rule or is there any
other way to debug what may be failing to trigger an alert? If anyone has
any insight on how to get a rule like this to work I would appreciate the
assistance.

Thanks,


-- 
Ryan Pettigrew

------------------------------------------------------------------------------
EditLive Enterprise is the world's most technically advanced content
authoring tool. Experience the power of Track Changes, Inline Image
Editing and ensure content is compliant with Accessibility Checking.
http://p.sf.net/sfu/ephox-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please see http://www.snort.org/docs for documentation