[Snort-users] uricontent questions

Jeremy Hewlett jh at ...1935...
Thu Mar 3 08:39:53 EST 2005

On Wed, Mar 02, Brad W Rothwell wrote:
>    I changed it to a more generic form.
>    alert tcp any any <> any any (msg: "foo found";
>    uricontent:"foo"; nocase;)
>    and it still does not trip an alert.  Ideas?

You will find your answer here:

More information about the Snort-users mailing list