[Snort-users] uricontent vs. content

Andreas Östling andreaso at ...236...
Thu Oct 31 00:54:04 EST 2002

On Wednesday 30 October 2002 02.28, larosa, vjay wrote:
> Shouldn't both of these rules work, (with the first one being more
> accurate)? Or am I interpreting the uricontent
> keyword incorrectly?

This may be a stupid question, but are you sure you loaded the http_decode 
preprocessor and that you don't get any error message from it on startup?
Uricontent will not work without it. 

Both your rules works for me.


More information about the Snort-users mailing list