[Snort-users] uricontent vs. content

Andreas Östling andreaso at ...236...
Thu Oct 31 00:54:04 EST 2002


On Wednesday 30 October 2002 02.28, larosa, vjay wrote:
...
> Shouldn't both of these rules work, (with the first one being more
> accurate)? Or am I interpreting the uricontent
> keyword incorrectly?

This may be a stupid question, but are you sure you loaded the http_decode 
preprocessor and that you don't get any error message from it on startup?
Uricontent will not work without it. 

Both your rules works for me.

/Andreas





More information about the Snort-users mailing list