Snort mailing list archives
Re: how to inspect http payload
From: "lists () packetmail net" <lists () packetmail net>
Date: Fri, 25 May 2012 08:52:23 -0500
On 05/25/12 06:47, 曾代科 wrote:
why the snort can't match the content to the payload?
Hello, in your snort.conf in http_inspect make sure you have set inspect_gzip. Check your http_inspect settings against http://www.snort.org/vrt/snort-conf-configurations/ Thank you, Nathan ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- how to inspect http payload 曾代科 (May 25)
- Re: how to inspect http payload Rodrigo Montoro(Sp0oKeR) (May 25)
- Re: how to inspect http payload lists () packetmail net (May 25)