[Snort-sigs] File size

Oscar A o_ama_lo at ...12...
Thu Oct 30 18:15:03 EDT 2014


Thanks,
 is in a sourcefire device, I dont know if there is a stream5 
configuration, the uploads are made by http and I want to make tha 
uploads larger than 8 MB dont complete in the server

From: o_ama_lo at ...12...
To: lists at ...3397...
Subject: RE: [Snort-sigs] File size
Date: Thu, 30 Oct 2014 16:02:33 -0600




Thanks, is in a sourcefire device, I dont know if there is a stream5 configuration, the uploads are made by http and I want to make tha uploads larger than 8 MB dont complete in the server

> From: lists at ...3397...
> To: snort-sigs at lists.sourceforge.net
> Date: Thu, 30 Oct 2014 13:03:35 -0500
> Subject: Re: [Snort-sigs] File size
> 
> On 10/30/2014 12:58 PM, Oscar A wrote:
> > How can I make a policy to drop all connections that overpass certain file size
> > limit?
> 
> Configure http_inspect and stream5 to meet your needs and then perhaps use
> file_data with isdataat.
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
> 
> 
> Please visit http://blog.snort.org for the latest news about Snort!
 		 	   		   		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20141030/78a4768d/attachment.html>


More information about the Snort-sigs mailing list