Snort mailing list archives
Re: [Snort-sigs] http_inspect
From: Brian caswell <bmc () snort org>
Date: Fri, 30 Jul 2004 01:05:36 -0400
On Jul 29, 2004, at 3:05 PM, Esler, Joel - Contractor wrote:
detect_anomalous_servers config for http_inspect. When I turn it on, it works, but it detects return HTTP traffic as opposed to HTTP traffic to non $HTTP_SERVERS, I am assuming that this is the probem with it right now and they are going to fix it? Or do I have something misconfig?
The detect_anomalous_servers configuration option looks for HTTP traffic on non-HTTP ports. Basically, if someone starts running a web server on ports other than the ones you already have defined, snort will generate the alert "(http_inspect) ANOMALOUS HTTP SERVER ON UNDEFINED HTTP PORT" from this configuration.
Brian ------------------------------------------------------- This SF.Net email is sponsored by OSTG. Have you noticed the changes on Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now, one more big change to announce. We are now OSTG- Open Source Technology Group. Come see the changes on the new OSTG site. www.ostg.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- http_inspect Esler, Joel - Contractor (Jul 29)
- Re: [Snort-sigs] http_inspect Brian caswell (Aug 02)
- Re: [Snort-sigs] http_inspect Jeremy Hewlett (Aug 03)