this rule wont work.  if i remember correctly, i dont think you want ur destination variable as http_servers...<br><br><div class="gmail_quote">On Tue, Apr 22, 2008 at 7:07 AM, rmkml <<a href="mailto:rmkml@...324...">rmkml@...324...</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Hi,<br>
<br>
Crusoe Researches offering a new rule for detecting Safari Windows DoS:<br>
  <a href="http://www.Crusoe-Researches.com/en/safariwindowsfiledos.txt" target="_blank">http://www.Crusoe-Researches.com/en/safariwindowsfiledos.txt</a><br>
<br>
Credits:<br>
Crusoe Researches<br>
<a href="http://www.Crusoe-Researches.com" target="_blank">http://www.Crusoe-Researches.com</a><br>
contact@...3281...<br>
=> Crusoe Researches have more than 2806 UNIQ 'snort' rules for Commercial Access<br>
         (Contact me directly if you are interested)<br>
<br>
Crusoe Researches support Bro idps v1.3.25 project format rules<br>
(<a href="http://www.bro-ids.org/" target="_blank">http://www.bro-ids.org/</a>):<br>
signature sid-92806 {<br>
   ip-proto == tcp<br>
   event "WEB-CLIENT Safari file:// and % attempt"<br>
   tcp-state established,responder<br>
   http-body /.*[^a-zA-Z0-9][fF][iI][lL][eE]\:\/\/(.){0,2}\%/<br>
   }<br>
<br>
<br>
Azwalaro new nidps open source project (WireShark based)<br>
  <a href="http://www.Crusoe-Researches.com/azwalaro/" target="_blank">http://www.Crusoe-Researches.com/azwalaro/</a><br>
  azwalaro@...3281...<br>
  http matches "(?i)[^a-z0-9]file://(.){0,2}%"<br>
<br>
Regards<br>
Rmkml<br>
Crusoe-Researches.com<br>
<br>
-------------------------------------------------------------------------<br>
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference<br>
Don't miss this year's exciting event. There's still time to save $100.<br>
Use priority code J8TL2D2.<br>
<a href="http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone" target="_blank">http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone</a><br>
_______________________________________________<br>
Snort-sigs mailing list<br>
<a href="mailto:Snort-sigs@lists.sourceforge.net">Snort-sigs@lists.sourceforge.net</a><br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-sigs" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-sigs</a><br>
</blockquote></div><br>