[Snort-users] sql.rules and instanat messenging
slave_tothe_box at ...131...
Wed Apr 30 09:14:05 EDT 2003
Real quick...wondering what I need to do to get
sql.rules running. It works like a champ at home, but
not at work :( External is set to the internal lan as
well as the external netblock...it comes in...even is
seen as a portscan, but no msql rule shows up. The
box that snort is running on is us is using kernel
bridging to bridge 2 nics on...I have eth0, eth1, and
br0...br0 has an ip, but the other 2 do not. I'm
binding snort to eth1 which is the external if...any
issues with that maybe? Also, I have a script that
runs with wots that will add any ip that portscans to
the firewall list for 5 minutes...anything I'm missing
Next is TRYING to content filter instant messaging. I
stole a rule off of the porn.rules and added:
alert tcp $EXTERNAL_NET 1863 <- $HOME_NET any
(msg:"PORN testingjimbo"; content:"testingjimbo";
nocase; classtype:kickass-porn; sid:1833; rev:1;)
I've tried adding the flow:established and also tried
<-> to track both ends of the session...no go
though..still not seeing it. Anyone know of what I'm
doing wrong? Thanks people!
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
More information about the Snort-users