[Snort-users] Rules question. Or clause with content keyword in rule.

Al Lewis (allewi) allewi at ...589...
Sun Feb 1 18:30:27 EST 2015


http://manual.snort.org/node32.html#SECTION004517000000000000000

An example is listed in that section of the manual.

Hope this helps.


Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi at ...589...

From: Andrei_1980 [mailto:andrei_1980 at ...1975...]
Sent: Sunday, February 01, 2015 5:32 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Rules question. Or clause with content keyword in rule.

Hello! I want create rule, that will fire if uri not contain some substrings.  For example, my site has two pages: main.htm and test.html, and I want write  rule like:
content: ! “main.html” or !“test.html”; http_uri;

Is any way to do this in Snort?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150201/d329f22e/attachment.html>


More information about the Snort-users mailing list