[Snort-users] Local alert for website traffic not working

Ryan Pettigrew rino655 at ...11827...
Mon Jun 20 15:20:01 EDT 2011


Hi guys,

I have recently been trying to get a local rule working that would alert
when a user accesses a certain webpage. As a test rule, I added the
following line in my local.rules file:

alert tcp any any -> any any (msg:"test eBay rule"; flow:established;
content:"ebay.com"; sid:1000002;rev:1;)

After restarting snort and barnyard and going to the website, I am not
seeing any alerts from snort.
I am certain that other web rules are working because the following local
rule alerts just fine:

alert tcp any any <> any 80 (msg: "Test web activity"; sid:1000001;)

Is there an issue with the way I am writing the ebay rule or is there any
other way to debug what may be failing to trigger an alert? If anyone has
any insight on how to get a rule like this to work I would appreciate the
assistance.

Thanks,


-- 
Ryan Pettigrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110620/3610df32/attachment.html>


More information about the Snort-users mailing list