[Snort-devel] preprocessor http_inspect

Daniel Roelker droelker at ...402...
Fri Nov 19 12:59:03 EST 2004


This is on the list for the 2.4 release.  When we start a release
candidate cycle for 2.4, please be sure to try it out and give us your
feedback.

Thanks,
Dan

On Thu, 2004-11-11 at 06:45, Passreality wrote:
> I have been testing different setups to get rid of the
> waste amount of alerts in my system. Not sure if im
> missing something or if the http_inspect is "missing"
> a feature.
> The Feature im looking for is the ability to only
> check ips that are defined in the HOME_NET range. This
> way i will not get all alerts concerning webserver
> that are not located on my net.
> 
> I see two diffrent ways to solve it.
> 1. Is to have the "preprocessor http_inspect: global"
> take one more parameter "only_home_net"
> 2. Let the IP parameter to "http_inspect_server:
> server [IP]" take a range value.
> 
> /Chriss
> 
> 
> 		
> __________________________________ 
> Do you Yahoo!? 
> Check out the new Yahoo! Front Page. 
> www.yahoo.com 
>  
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: InterSystems CACHE
> FREE OODBMS DOWNLOAD - A multidimensional database that combines
> robust object and relational technologies, making it a perfect match
> for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 
-- 
Daniel Roelker
Lead Snort Developer
Sourcefire, Inc.





More information about the Snort-devel mailing list