[Snort-users] http_inspect_server question

Jason Wallace jason.r.wallace at ...11827...
Mon Mar 16 09:42:25 EDT 2009


Hi,

I'm currently using snort-2.8.4-rc1.

Is it valid to have multiple profiles for the same IP but different ports?

preprocessor http_inspect_server: server 192.168.50.10 profile iis ports { 80 }

And then right below it do...

preprocessor http_inspect_server: server 192.168.50.10 profile all
ports { 8080 }


I have a couple of servers running IIS on 80 that also host web based
apps on other ports. I'd like to stick to the IIS profile on 80 and
use the all profile for these other apps.


thx,
Wally




More information about the Snort-users mailing list