[Snort-users] uricontent vs. content

larosa, vjay larosa_vjay at ...3331...
Thu Oct 31 04:37:05 EST 2002


What a bonehead I am! For some reason I commented out the http_decode
pre-processor!
Thanks for your help Andreas! I will re-enable it and test it when I get in
to work.

vjl

-----Original Message-----
From: Andreas Östling [mailto:andreaso at ...236...]
Sent: Thursday, October 31, 2002 3:53 AM
To: larosa, vjay
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] uricontent vs. content



On Wednesday 30 October 2002 02.28, larosa, vjay wrote:
...
> Shouldn't both of these rules work, (with the first one being more
> accurate)? Or am I interpreting the uricontent
> keyword incorrectly?

This may be a stupid question, but are you sure you loaded the http_decode 
preprocessor and that you don't get any error message from it on startup?
Uricontent will not work without it. 

Both your rules works for me.

/Andreas




More information about the Snort-users mailing list