Snort mailing list archives
Content rule problem
From: Antonio Eugenio Villar <eugeniovillar () yahoo com>
Date: Fri, 16 Apr 2004 10:55:30 -0700 (PDT)
Seems weird but the rule below is not working on Snort 2.1.2. I appreciate some help. alert tcp any any -> any any (msg: "XX"; content: ".ida?"; ) I also tried with uricontent and did not work. I am reading a file with -r options with packet using GET /default.ida? I have default snort.conf file. I did include this rule above. __________________________________ Do you Yahoo!? Yahoo! Tax Center - File online by April 15th http://taxes.yahoo.com/filing.html ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Content rule problem Antonio Eugenio Villar (Apr 16)
- Re: Content rule problem Matt Kettler (Apr 16)