[Snort-users] uricontent misbehaving?

Martin Roesch roesch at ...1935...
Fri Nov 2 12:11:45 EST 2001


It depends.  The uricontent keyword is linked to having the http_decode
preprocessor turned on (yes, I know it's not orthogonal).  Basically, if
http_decode isn't turned on Snort won't generate the URI data in the
packet structure and the uricontent keyword will operate exactly as the
content keyword does.  You also need to have your $EXTERNAL_NET set to
!$HOME_NET if you don't want to catch outbound traffic as well.

[Original message snipped to halt the flood of email anti-virus systems
false alarming on the name of the file in question that was part of that
email.  Wow, anti-virus software is lame...]

     -Marty


--
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...1935... - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org




More information about the Snort-users mailing list