[Snort-sigs] File size

lists at ...3397... lists at ...3397...
Thu Oct 30 14:03:35 EDT 2014

On 10/30/2014 12:58 PM, Oscar A wrote:
> How can I make a policy to drop all connections that overpass certain file size
> limit?

Configure http_inspect and stream5 to meet your needs and then perhaps use
file_data with isdataat.

More information about the Snort-sigs mailing list