[Snort-users] test string not alerting

Al Lewis (allewi) allewi at ...589...
Thu Aug 27 15:30:12 EDT 2015


Are you generating tcp based traffic that contains the content “poop”?

Also your rule SID should be above one million for local rules.

Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi at ...589...

From: Sean [mailto:sean.barmettler at ...11827...]
Sent: Thursday, August 27, 2015 3:05 PM
To: Snort-users at lists.sourceforge.net
Subject: [Snort-users] test string not alerting

I can do a simple ICMP alert that works:
alert icmp any any -> any ( msg: "ICMP packet to high value target!"; sid: 1; rev:1; priority: 1;)

Yet I cant create a simple text string detector to detect HTML strings:
alert tcp any any <> any any (msg:"somebody farted"; content:"poop"; sid: 2; rev:2; priority: 1;)

I wouldnt waste a mailing lists time with this, but I've setup an entire ESXI lab with routers, switches, security monitors, and THIS.. THIS is what is stumping me.

hints/clues/suggestions welcome.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150827/c60bb125/attachment.html>

More information about the Snort-users mailing list