Snort mailing list archives
RE: snort newbie question
From: swilcoxon () iqmarketing com
Date: Fri, 13 Jul 2001 09:30:16 -0500
-----Original Message----- From: Kiira Triea [mailto:kiira-t () mail bsasinc org] Sent: Friday, July 13, 2001 6:21 AM To: snort-users () lists sourceforge net Subject: Re: [Snort-users] snort newbie question
<SNIP>
Hi, this is easy - you can put a 'logto:"foobar.log";' in the rules you want to log seperately. So in smtp.rules add like: alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP email from Satan"; \ content:"from:satan () hell org";nocase;logto:"hotmail.log";) Kiira
I didn't think Hell would be considered a .org, I always thought they were for profit! S.W. swilcoxon () iqmarketing com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort newbie question twig les (Jul 12)
- Re: snort newbie question Kiira Triea (Jul 13)
- <Possible follow-ups>
- RE: snort newbie question swilcoxon (Jul 13)