[Snort-users] Multiple Content (not working?)

Carlos Kumbak ckumbak at ...1331...
Wed May 15 01:27:04 EDT 2002


I'm with some problems here while trying to configure
multiple content options to a rule.

I need to block a unique e-mail address to send messages
to all my users, but this messages can be posted to me.

well... I've tried two rules:
pass tcp $SMTPX any -> $MYSMTP 25
(content:"that at ...1266...";nocase;content:"my at ...1266...";n
alert tcp $SMTPX any -> $MYSMTP 25
(content:"that at ...1266...";nocase;resp:rst_all;)

May anyone help me to this work? plz!
I've lost some nights trying to figure out what's wrong.

Thanks in advance.

Best Regards
Carlos Kumbak
ckumbak at ...1331...

Quer ter seu próprio endereço na Internet?
Garanta já o seu e ainda ganhe cinco e-mails personalizados.
DomíniosBOL - http://dominios.bol.com.br

More information about the Snort-users mailing list