[Snort-users] uricontent vs. content

larosa, vjay larosa_vjay at ...3331...
Thu Oct 31 04:37:05 EST 2002

What a bonehead I am! For some reason I commented out the http_decode
Thanks for your help Andreas! I will re-enable it and test it when I get in
to work.


-----Original Message-----
From: Andreas Östling [mailto:andreaso at ...236...]
Sent: Thursday, October 31, 2002 3:53 AM
To: larosa, vjay
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] uricontent vs. content

On Wednesday 30 October 2002 02.28, larosa, vjay wrote:
> Shouldn't both of these rules work, (with the first one being more
> accurate)? Or am I interpreting the uricontent
> keyword incorrectly?

This may be a stupid question, but are you sure you loaded the http_decode 
preprocessor and that you don't get any error message from it on startup?
Uricontent will not work without it. 

Both your rules works for me.


More information about the Snort-users mailing list