[Snort-users] Newbie question
erek at ...577...
Tue Mar 5 18:23:13 EST 2002
On Tue, 5 Mar 2002, Jhumri Tilayia wrote:
> Well, I assume that because it's a Network IDS, it sniffs packets. Will it
> let me (for example) write a rule that looks for certain HTTP requests,
> without specifying the whole IP packet (i.e. can it intelligently decode the
> protocol stack?). Since with TCP, a given request could be split across
> multiple packets, can it decode a whole stream (like Ethereal does)?
Have a look at the FAQ as it answers a lot of common questions.
Those two links pertain to your questions.
More information about the Snort-users