Re: How's best to alert on Web connections that *don't* contain particular content?

[Jason Haar <Jason.Haar () trimble co nz>]

On Tue, Feb 25, 2003 at 04:04:09PM -0600, Kenneth G. Arnold wrote:
> You could write an alert to catch all port 80 connections but write a pass
> rule that would be processed first that lets the Trendmicro traffic be
> ignored.

Yeah - but the problem with those sorts of rules is that you end up skipping
the rest of the IDS rules too. This rule needs to be at the top so that it
triggers before any "normal" rule can get at it. (that's because any match
is a "pagable" event vs just a standard alert: you should know you're
compromised if one of these trigger).

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users