[Snort-users] http_inspect config options?

Rich Adamson radamson at ...2127...
Sat Feb 26 05:07:38 EST 2005


I'm trying to tune the http_inspect preprocessor on a v2.3rc2 win32
system using an entry like:

preprocessor http_inspect_server: server 10.1.0.3 \
    profile iis ports { 80 8080 8180 } oversize_dir_length 500 \ 
    double_decode no

After making the change to include the "double_decode no" statement,
snort fails to start complain about that statement. Commenting it
out allows snort to start correctly.

The doc\README.http_inspect file suggests this is a valid option,
but I can't seem to find a syntax that actually is accepted. The
sample in the etc\snort.conf suggests I'm using the correct syntax
but obviously something is amiss.

Thoughts anyone?







More information about the Snort-users mailing list