[Snort-users] http_* keywords

Eoin Miller eoin.miller at ...14586...
Thu Aug 19 18:37:54 EDT 2010


  So if a rule has an http_* keyword (http_uri, http_client_body, 
http_method) but the snort configuration does not allow the use of it 
because it is missing in the http_inspect configuration section, why 
does the rule choose to match and fire for that content that is using 
that keyword modifier?

-- Eoin




More information about the Snort-users mailing list