[Snort-users] logging abnormal traffic

Wim Fournier hsmade at ...11827...
Wed Jan 16 05:30:25 EST 2008


Hi all,

I'm a newbie on this product, so please excuse me for asking stupid
questions ;o)

I want to monitor traffic to a our web servers. The traffic is very
well and easy defined. A definition would look like:

client requests /some/dir/file?param=value&param2=value2&....etc
Server responds with 200 OK and a GIF picture or a 302

Now I want to log anything that does not match this, as in web
requests that don't match this pattern and other requests than GET.
Is there an easy way to do this? Like first defining the accepted
traffic and logging anything else?

Thanks for any clues, pointers, whatever

Wim




More information about the Snort-users mailing list