[Snort-users] logging abnormal traffic
hsmade at ...11827...
Wed Jan 16 05:30:25 EST 2008
I'm a newbie on this product, so please excuse me for asking stupid
I want to monitor traffic to a our web servers. The traffic is very
well and easy defined. A definition would look like:
client requests /some/dir/file?param=value¶m2=value2&....etc
Server responds with 200 OK and a GIF picture or a 302
Now I want to log anything that does not match this, as in web
requests that don't match this pattern and other requests than GET.
Is there an easy way to do this? Like first defining the accepted
traffic and logging anything else?
Thanks for any clues, pointers, whatever
More information about the Snort-users