[Snort-users] Local alert for website traffic not working
rino655 at ...11827...
Mon Jun 20 15:00:06 EDT 2011
I have recently been trying to get a local rule working that would alert
when a user accesses a certain webpage. As a test rule, I added the
following line in my local.rules file:
alert tcp any any -> any any (msg:"test eBay rule"; flow:established;
After restarting snort and barnyard and going to the website, I am not
seeing any alerts from snort.
I am certain that other web rules are working because the following local
rule alerts just fine:
alert tcp any any <> any 80 (msg: "Test web activity"; sid:1000001;)
Is there an issue with the way I am writing the ebay rule or is there any
other way to debug what may be failing to trigger an alert? If anyone has
any insight on how to get a rule like this to work I would appreciate the
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users