[Snort-users] uricontent questions

Brad W Rothwell ROTHBW at ...1871...
Wed Mar 2 15:30:27 EST 2005


I changed it to a more generic form. 
alert tcp any any <> any any (msg: "foo found"; 
uricontent:"foo"; nocase;)
and it still does not trip an alert.  Ideas?

Brad Rothwell
INL/ICP Cyber Security




Matt Kettler <mkettler at ...4108...> 
Sent by: snort-users-admin at lists.sourceforge.net
03/02/2005 02:43 PM

To
Brad W Rothwell <ROTHBW at ...1871...>, snort-users at lists.sourceforge.net
cc

Subject
Re: [Snort-users] uricontent questions






At 02:54 PM 3/2/2005, Brad W Rothwell wrote:
>All,  I recently installed snort 2.3.0.  My understanding is that I can 
>use uricontent to search for strings as they appear in the browser 
address 
>location bar.  For example, if the address location is 
><http://foo.com/>http://foo.com the following rule should alert.
>
>alert tcp any any <> $HTTP_SERVERS any (msg: "foo found"; 
>uricontent:"foo"; nocase;)
>
>I have http_inspect set to the following
>preprocessor http_inspect: global \
>     iis_unicode_map unicode.map 1252
>
>preprocessor http_inspect_server: server default \
>     profile all ports { 80 8080 8180 } oversize_dir_length 500 
flow_depth 0
>
>The rule does not alert.  Am I missing something.


what is HTTP_SERVERS set to? The above rule will only alert if the server 
for foo.com is actualy a part of that net range.





-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050302/4caf3a31/attachment.html>


More information about the Snort-users mailing list