[Snort-sigs] how to inspect http payload

lists at ...3397... lists at ...3397...
Fri May 25 09:52:23 EDT 2012


On 05/25/12 06:47, 曾代科 wrote:
> why the snort can't match the content to the payload?

Hello, in your snort.conf in http_inspect make sure you have set inspect_gzip.
Check your http_inspect settings against
http://www.snort.org/vrt/snort-conf-configurations/

Thank you,
Nathan





More information about the Snort-sigs mailing list