[Snort-sigs] Re: [snort-cvs] CVS: snort - cazz

Chris Green cmg at ...435...
Mon May 13 07:33:05 EDT 2002


Brian Caswell <cazz at ...592...> writes:

> The port that we check all of the web signatures against is set with the
> HTTP_PORTS variable.  If you have web servers running on more than one port,
> you should enable the signatures like this:
>
> var HTTP_PORTS 80
> include web-cgi.rules
> var HTTP_PORTS 8080
> include web-cgi.rules

If you do this, make sure to add 8080 to the http_decoder as well.

-- 
Chris Green <cmg at ...435...>
Eschew obfuscation.





More information about the Snort-sigs mailing list