Snort mailing list archives

writting alert rules


From: Akinwale Fasuru <fashman2k1 () yahoo com>
Date: Thu, 1 Nov 2012 15:15:37 -0700 (PDT)

Hi,
I wrote a rule for alert on visiting www.youtube.com
alert rule
alert tcp any any => any any (msg:"someone is on youtube now!"; content:"www.youtube.com"; sid:1000002;rev:1;)

Here is the response i got when i go on youtube

10/25-22:29:59.126487  [**] [129:15:1] Reset outside window [**] [Classification: Potentially Bad Traffic] [Priority: 
2] {TCP} 157.56.134.97:80 -> 192.168.64.133:42987

Can somebody help pls, not sure what is wrong

------------------------------------------------------------------------------
LogMeIn Central: Instant, anywhere, Remote PC access and management.
Stay in control, update software, and manage PCs from one command center
Diagnose problems and improve visibility into emerging IT issues
Automate, monitor and manage. Do more in less time with Central
http://p.sf.net/sfu/logmein12331_d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


Current thread: