(no subject)

[Patrice.Arnal () alcatel fr]

Hello

I have some difficulties to write a rule that raise an alert for all cases 
except one.

For instance : There is a rule in web-cgi.rules :
it says : 

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS,!212.180.75.34/32 80 
(msg:"WEB-CGI calendar access";flags:A+; uricontent:"/calendar"; nocase; 
classtype:attempted-recon; sid:882; rev:1;)

BUT I have a site with a "Calendar.gif file" .  What I want is uricontent 
"/calendar" but NOT Calendar.gif

In the same way there is a rule on Names.nsf , but Names.nsf?Login is 
Legal ( it is the Only legal access )

Thank you for the help

Patrice ARNAL
ALCANET France
Site d'ILLKIRCH
1 Route du Dr Albert SCHWEITZER
67408 ILLKIRCH CEDEX

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users