[Snort-users] Multiple Content (not working?)

F.M. Taylor root at ...28...
Fri May 17 08:01:02 EDT 2002


The only practical way I can think of to do what you want is to use
procmail with a global configuration file.  Using that method you could
discard message based baasically on aany rules you want.  I don't think
there is any way for snort to do whaat you want.

On Thu, 16 May 2002, Carlos Kumbak wrote:

> Hello,
> 
> I agree with you both... but it's a solution to a 
> problem I have here.
> 
> I'm using qmail... and I didn't see anything (patch or 
> something) to do this what I need:
> 
> "IF e_mail_from_that_address AND 
> recipient_is_not_my_address THEN drop the connection."
> 
> I was trying to use snort to solve this problem... but  
> after some nights without even blink my eyes (a lot of  
> caffeine) trying to do it (unsucessful) I've decided do 
> ask help to this list.
> 
> So... lets go for the final question: (drums) :)
> "Is it possible? If yes... how?"
> 
> Thanks once again.
> 
> 
> Best Regards
> 


-- 
Mike Taylor
Coordinator of Systems Administration and Network Security
Indiana State University.               Rankin Hall Rm 053
210 N 7th St.                           Terre Haute, IN.
SANS GSEC  http://www.sans.org/





More information about the Snort-users mailing list