[Snort-sigs] RE: Snort Rule Howto

Andrews Carl 448 Carl.Andrews at ...2744...
Fri Aug 27 09:30:05 EDT 2004


Thanks for the reply. I have not even seen my messages appear on the list,
not even this one just your reply. This is the first time I have tried to
send a message, does the sender not get a message? 

Thanks !

-----Original Message-----
From: Harper, Patrick [mailto:patrick.harper at ...1819...]
Sent: Friday, August 27, 2004 10:01 AM
To: Andrews Carl 448; snort-sigs at lists.sourceforge.net
Subject: RE: [Snort-sigs] RE: Snort Rule Howto


I show 3 posting (including this one)  do you mean answered?  I would
help you out but I suck at rule writing and I have never done any
flexresp rules.  Are you compiled with flexresp support?


Patrick S. Harper | CISSP RHCT MCSE
Information Security Engineer
patrick.harper at ...1819... 
 
-----Original Message-----
From: Andrews Carl 448 [mailto:Carl.Andrews at ...2744...] 
Sent: Friday, August 27, 2004 8:07 AM
To: Andrews Carl 448; 'snort-sigs at lists.sourceforge.net'
Subject: [Snort-sigs] RE: Snort Rule Howto

Why do my questions not get posted? I am a member of the list. 

-----Original Message-----
From: Andrews Carl 448
Sent: Friday, August 20, 2004 12:30 PM
To: Andrews Carl 448; 'snort-sigs at lists.sourceforge.net' 
Subject: RE: Snort Rule Howto 




-----Original Message-----
From: Andrews Carl 448
Sent: Thursday, August 19, 2004 2:10 PM
To: snort-sigs at lists.sourceforge.net
Subject: Snort Rule Howto 


Hi! If anyone can help, it would be much appreciated. 
I need to write a rule(s) to block certain types of files from crossing
the network to/from a computer. For instance, I would like to use the
FLEXRESP option to terminate a connection if and EXE,DLL,ZIP, etc is
copied to or from this server. My goal is to setup a server for web
proxying that does not allow anything even remotely executable to pass
through it. I have searched and have not found any viable proxy server
software that does mime type filtering.

Thanks in advance,
Carl 





Disclaimer:
This electronic message, including any attachments, is confidential and
intended solely for use of the intended recipient(s). This message may
contain information that is privileged or otherwise protected from
disclosure by applicable law. Any unauthorized disclosure, dissemination,
use or reproduction is strictly prohibited. If you have received this
message in error, please delete it and notify the sender immediately. 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20040827/449943da/attachment.html>


More information about the Snort-sigs mailing list