[Snort-users] http_inspect different servers same IP

Jason Wallace jason.r.wallace at ...11827...
Tue Nov 10 14:57:48 EST 2009


Will the following work?

preprocessor http_inspect_server: server 10.75.88.11 \
                                  profile iis \
                                  server_flow_depth 0 \
                                  client_flow_depth 0 \
                                  ports { 80 }

preprocessor http_inspect_server: server 10.75.88.11 \
                                  profile appache \
                                  server_flow_depth 0 \
                                  client_flow_depth 0 \
                                  ports { 8080 }

Will that analyze traffic on 80 as IIS and on 8080 as apache?




More information about the Snort-users mailing list