Snort mailing list archives
web proxies and aplication servers
From: Jorge Cuevas <jcuevas () nesys-st com>
Date: Fri, 28 Dec 2007 16:09:24 +0100
Hi all I am trying to set up my http_inspect preprocessor. If I have a Squid proxy listening on ports 80 and 8080, do I need to configure a preprocessor http_inspect_server for it? And should I use apache profile? If I am using any other web server (neither IIS nor Apache), do I need to configure a preprocessor http_inspect_server for it? If so, which profile? And same question about application servers, like AOL for example. Do I need to configure http_inspect_server for it? Which profile? I am getting thousands of alerts do to web requests from my proxy clients, and I think all of them are false positives, but I am not sure If is correct enough bypassing http_inspect for my proxy or web applications. Thanks in advance, Regards, Jorge -- Jorge Cuevas González <jcuevas () nesys-st com> Director de Proyectos www.nesys-st.com Tfno: 94 406 0546 Móvil: 617165161 GPG: 3C1C CE59 3258 07C6 BB44 76B2 7861 9F93 9710 0C6F ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- web proxies and aplication servers Jorge Cuevas (Dec 28)