[Snort-users] Content rule problem

Antonio Eugenio Villar eugeniovillar at ...131...
Fri Apr 16 10:56:06 EDT 2004

Seems weird but the rule below is not working on Snort
2.1.2. I appreciate some help.

alert tcp any any -> any any (msg: "XX"; content:
".ida?"; )

I also tried with uricontent and did not work. 
I am reading a file with -r options with packet using
GET /default.ida? 

I have default snort.conf file. I did include this
rule above.

Do you Yahoo!?
Yahoo! Tax Center - File online by April 15th

More information about the Snort-users mailing list