[Snort-users] (no subject)

Patrice.Arnal at ...4604... Patrice.Arnal at ...4604...
Thu Jan 17 01:02:03 EST 2002


Hello

I have some difficulties to write a rule that raise an alert for all cases 
except one.

For instance : There is a rule in web-cgi.rules :
it says : 

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS,!212.180.75.34/32 80 
(msg:"WEB-CGI calendar access";flags:A+; uricontent:"/calendar"; nocase; 
classtype:attempted-recon; sid:882; rev:1;)

BUT I have a site with a "Calendar.gif file" .  What I want is uricontent 
"/calendar" but NOT Calendar.gif

In the same way there is a rule on Names.nsf , but Names.nsf?Login is 
Legal ( it is the Only legal access )

Thank you for the help

Patrice ARNAL
ALCANET France
Site d'ILLKIRCH
1 Route du Dr Albert SCHWEITZER
67408 ILLKIRCH CEDEX




More information about the Snort-users mailing list