Re: uricontent questions

[Brad W Rothwell <ROTHBW () inel gov>]

I changed it to a more generic form. 
alert tcp any any <> any any (msg: "foo found"; 
uricontent:"foo"; nocase;)
and it still does not trip an alert.  Ideas?

Brad Rothwell
INL/ICP Cyber Security




Matt Kettler <mkettler () evi-inc com> 
Sent by: snort-users-admin () lists sourceforge net
03/02/2005 02:43 PM

To
Brad W Rothwell <ROTHBW () inel gov>, snort-users () lists sourceforge net
cc

Subject
Re: [Snort-users] uricontent questions






At 02:54 PM 3/2/2005, Brad W Rothwell wrote:
> All,  I recently installed snort 2.3.0.  My understanding is that I can 
> use uricontent to search for strings as they appear in the browser 
address 
> location bar.  For example, if the address location is 
> <http://foo.com/>http://foo.com the following rule should alert.
>
> alert tcp any any <> $HTTP_SERVERS any (msg: "foo found"; 
> uricontent:"foo"; nocase;)
>
> I have http_inspect set to the following
> preprocessor http_inspect: global \
>     iis_unicode_map unicode.map 1252
>
> preprocessor http_inspect_server: server default \
>     profile all ports { 80 8080 8180 } oversize_dir_length 500 
flow_depth 0
> The rule does not alert.  Am I missing something.


what is HTTP_SERVERS set to? The above rule will only alert if the server 
for foo.com is actualy a part of that net range.





-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users