Re: uricontent questions

[Matt Kettler <mkettler () evi-inc com>]

At 02:54 PM 3/2/2005, Brad W Rothwell wrote:
> All,  I recently installed snort 2.3.0.  My understanding is that I can 
> use uricontent to search for strings as they appear in the browser address 
> location bar.  For example, if the address location is 
> <http://foo.com/>http://foo.com the following rule should alert.
>
> alert tcp any any <> $HTTP_SERVERS any (msg: "foo found"; 
> uricontent:"foo"; nocase;)
>
> I have http_inspect set to the following
> preprocessor http_inspect: global \
>     iis_unicode_map unicode.map 1252
>
> preprocessor http_inspect_server: server default \
>     profile all ports { 80 8080 8180 } oversize_dir_length 500 flow_depth 0
>
> The rule does not alert.  Am I missing something.


what is HTTP_SERVERS set to? The above rule will only alert if the server 
for foo.com is actualy a part of that net range.





-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users