[Snort-sigs] Beginner Rule Problem

Joel Esler jesler at ...435...
Tue Oct 8 06:39:47 EDT 2013

No know how pfsense works here, so I am taking a shot in the dark. Try changing your Sid to 1000000, as 10001 is used. Try using a content match like  

content:"mtbr"; http_header;

More information about the Snort-sigs mailing list