[Snort-users] rule meaning

Raphael Bauduin rb at ...573...
Tue Oct 17 09:38:02 EDT 2000


I guess this will be regarded as a stupid question by some of you, but what's 
the exact purpose of the next rule? Is there a risk by not using it?

alert TCP any any -> any 80 (msg:"WEB-prefix-get //"; flags: PA; content:" 
get //"; nocase; )

Thanks!

Raph



-- 
              ---------------------------------- 
             |  -�)                        (�-  |
             |  /\\     Linux for ever     //\  |
             | _\_v                        v_/_ |
              ---------------------------------- 

   If windows is the answer, it must have been a stupid question.



More information about the Snort-users mailing list