Re: content question

[Martin Roesch <roesch () sourcefire com>]

In 1.8.x you can do this:

Alert tcp $HOME_NET $SOMEPORT -> any any (content: "DCC SEND"; nocase;
content: ".mp3"; nocase; msg: "MP3 DCC Found";)

In 1.9 you can do this:

Alert tcp $HOME_NET $SOMEPORT -> any any (flow: established, from_client;
content: "DCC SEND"; nocase; content: ".mp3"; distance: 1; nocase; msg: "MP3
DCC Found";)

The "distance" keyword gives you a relative offset from the end of the last
match, so it basically acts as a wildcarding mechanism.  You can also use
the new "within" keyword to limit how deep into the packet from the end of
the distance it'll search before it stops.

      -Marty


On 9/29/02 4:43 AM, "Petre Bandac" <petre () kgb ro> wrote:

> I want to block all dcc sends which contain mp3, avi, mpeg and other large
> files, allowing the rest
>
> am I allowd to use a wildcard in the content rule ? I presume not (haven't
> tried yet, though).
>
> can I concatenate two/more content rules ?
>
> my content text looks like this: DCC SEND any_file_name.mp3, and I am
> interested only in DCC SEND and the extension
>
>
> thanks,
>
> petre

-- 
Martin Roesch - Founder/CTO Sourcefire Inc. - (410) 290-1616
Sourcefire: Professional Snort Sensor and Management Console appliances
roesch () sourcefire com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users