Snort mailing list archives
Re: uricontent misbehaving?
From: Martin Roesch <roesch () sourcefire com>
Date: Fri, 02 Nov 2001 15:14:19 -0500
It depends. The uricontent keyword is linked to having the http_decode preprocessor turned on (yes, I know it's not orthogonal). Basically, if http_decode isn't turned on Snort won't generate the URI data in the packet structure and the uricontent keyword will operate exactly as the content keyword does. You also need to have your $EXTERNAL_NET set to !$HOME_NET if you don't want to catch outbound traffic as well. [Original message snipped to halt the flood of email anti-virus systems false alarming on the name of the file in question that was part of that email. Wow, anti-virus software is lame...] -Marty -- Martin Roesch - President, Sourcefire Inc. - (410)552-6999 roesch () sourcefire com - http://www.sourcefire.com Snort: Open Source Network IDS - http://www.snort.org _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- uricontent misbehaving? dan . ellis (Nov 02)
- Re: uricontent misbehaving? Tim Kramer (Nov 02)
- Re: uricontent misbehaving? Tim Kramer (Nov 02)
- Re: uricontent misbehaving? Chuck Morford (Nov 02)
- Re: uricontent misbehaving? Martin Roesch (Nov 02)
- Re: uricontent misbehaving? Brian (Nov 06)
- <Possible follow-ups>
- Re: uricontent misbehaving? Daniel Carroll (Nov 02)