[Snort-users] Multiple Content (not working?)
root at ...28...
Fri May 17 08:01:02 EDT 2002
The only practical way I can think of to do what you want is to use
procmail with a global configuration file. Using that method you could
discard message based baasically on aany rules you want. I don't think
there is any way for snort to do whaat you want.
On Thu, 16 May 2002, Carlos Kumbak wrote:
> I agree with you both... but it's a solution to a
> problem I have here.
> I'm using qmail... and I didn't see anything (patch or
> something) to do this what I need:
> "IF e_mail_from_that_address AND
> recipient_is_not_my_address THEN drop the connection."
> I was trying to use snort to solve this problem... but
> after some nights without even blink my eyes (a lot of
> caffeine) trying to do it (unsucessful) I've decided do
> ask help to this list.
> So... lets go for the final question: (drums) :)
> "Is it possible? If yes... how?"
> Thanks once again.
> Best Regards
Coordinator of Systems Administration and Network Security
Indiana State University. Rankin Hall Rm 053
210 N 7th St. Terre Haute, IN.
SANS GSEC http://www.sans.org/
More information about the Snort-users