Re: File size

[Oscar A <o_ama_lo () hotmail com>]

Thanks,
 is in a sourcefire device, I dont know if there is a stream5 
configuration, the uploads are made by http and I want to make tha 
uploads larger than 8 MB dont complete in the server

From: o_ama_lo () hotmail com
To: lists () packetmail net
Subject: RE: [Snort-sigs] File size
Date: Thu, 30 Oct 2014 16:02:33 -0600




Thanks, is in a sourcefire device, I dont know if there is a stream5 configuration, the uploads are made by http and I 
want to make tha uploads larger than 8 MB dont complete in the server

> From: lists () packetmail net
> To: snort-sigs () lists sourceforge net
> Date: Thu, 30 Oct 2014 13:03:35 -0500
> Subject: Re: [Snort-sigs] File size
>
> On 10/30/2014 12:58 PM, Oscar A wrote:
> > How can I make a policy to drop all connections that overpass certain file size
> > limit?
>
> Configure http_inspect and stream5 to meet your needs and then perhaps use
> file_data with isdataat.
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
>
>
> Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!