Re: snort not alerting on rule if IE is used

["Prashant cd c.d" <cdprashanth () gmail com>]

Hi Eoin/ rmklm
Thanks for reply
I am running Version 2.9.0.2 IPv6 (Build 92)
I prefer to find and update any config file paramters than upgrading to .5
Could you please let me know where I can find VRT rulepack
Thanks


On Mon, May 9, 2011 at 11:22 AM, Eoin Miller <
eoin.miller () trojanedbinaries com> wrote:

> On 5/9/2011 1:11 PM, Prashant cd c.d wrote:
>
> > Hi
> > I have snort rules to alert for specific host name and URL.
> > when I tested I see that snort is not alerting if I use internet explorer
> > 8, but alerting if i use firefox and safari
> > after analysis , i found that "Host" field is in bottom of request in case
> > of IE8 , and its on top in other browsers.
> > My config file has
> >
> > preprocessor http_inspect_server:  server default \
> >                                   profile all \
> >                                   ports { 80 8080 8001 } \
> >                                   flow_depth -1 \
> >                                   no_alerts
> >
> >  .it may be possibel that due to large GET header in IE, it is split into
> > multiple pkts.
> > I suspect that snort is not scanning all pkts of header
> > is it limitation
> > should i add anything in my conf file or add anything to http_inspect?
> >
> > thanks for help in advance
> >
> >  See this:
> http://trojanedbinaries.com/blog/?p=217
>
> I don't know if this has been fixed yet, but I know it was reported a while
> ago.
>
> 1) What version of Snort are you running?
> 2) Check out the snort.conf that comes with the VRT rulepack for the best
> way to start your http_inspect configuration.
>
> -- Eoin
>
> -- Eoin
------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users