[Snort-users] uricontent vs. content
larosa_vjay at ...3331...
Thu Oct 31 04:37:05 EST 2002
What a bonehead I am! For some reason I commented out the http_decode
Thanks for your help Andreas! I will re-enable it and test it when I get in
From: Andreas Östling [mailto:andreaso at ...236...]
Sent: Thursday, October 31, 2002 3:53 AM
To: larosa, vjay
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] uricontent vs. content
On Wednesday 30 October 2002 02.28, larosa, vjay wrote:
> Shouldn't both of these rules work, (with the first one being more
> accurate)? Or am I interpreting the uricontent
> keyword incorrectly?
This may be a stupid question, but are you sure you loaded the http_decode
preprocessor and that you don't get any error message from it on startup?
Uricontent will not work without it.
Both your rules works for me.
More information about the Snort-users