[Snort-users] uricontent questions

Jeremy Hewlett jh at ...1935...
Thu Mar 3 08:39:53 EST 2005


On Wed, Mar 02, Brad W Rothwell wrote:
> 
>    I changed it to a more generic form.
>    alert tcp any any <> any any (msg: "foo found";
>    uricontent:"foo"; nocase;)
>    and it still does not trip an alert.  Ideas?

You will find your answer here:
http://marc.theaimsgroup.com/?l=snort-users&m=110970442302280&w=2






More information about the Snort-users mailing list