[Snort-users] Local alert for website traffic not working

Ryan Pettigrew rino655 at ...11827...
Mon Jun 20 15:00:06 EDT 2011

Hi guys,

I have recently been trying to get a local rule working that would alert
when a user accesses a certain webpage. As a test rule, I added the
following line in my local.rules file:

alert tcp any any -> any any (msg:"test eBay rule"; flow:established;
content:"ebay.com"; sid:1000002;rev:1;)

After restarting snort and barnyard and going to the website, I am not
seeing any alerts from snort.
I am certain that other web rules are working because the following local
rule alerts just fine:

alert tcp any any <> any 80 (msg: "Test web activity"; sid:1000001;)

Is there an issue with the way I am writing the ebay rule or is there any
other way to debug what may be failing to trigger an alert? If anyone has
any insight on how to get a rule like this to work I would appreciate the


Ryan Pettigrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110620/2942c562/attachment.html>

More information about the Snort-users mailing list