Re: snort not alerting on rule if IE is used

["Prashant cd c.d" <cdprashanth () gmail com>]

thanks
i want mention that i am only interested in http client GET requests
i wont scan for http server response.
I added client_flow_depth 0   and it seems to be working fine.
Will have to test more and with different browsers




On Mon, May 9, 2011 at 11:33 AM, Eoin Miller <
eoin.miller () trojanedbinaries com> wrote:

> On 5/9/2011 3:25 PM, Prashant cd c.d wrote:
>
> > Hi Eoin/ rmklm
> > Thanks for reply
> > I am running Version 2.9.0.2 IPv6 (Build 92)
> > I prefer to find and update any config file paramters than upgrading to .5
> > Could you please let me know where I can find VRT rulepack
> > Thanks
> you can download the VRT rulesets and configs at this location:
> http://www.snort.org/snort-rules/
>
> There is a bug in the current snort.conf that is distributed for the
> registered users that I know of, here is the http_inspect portion of
> snort.conf that is all fixed:
>
> preprocessor http_inspect: global iis_unicode_map unicode.map 1252
> compress_depth 65535 decompress_depth 65535
>
> preprocessor http_inspect_server: server default \
>    chunk_length 500000 \
>    server_flow_depth 0 \
>    client_flow_depth 0 \
>    post_depth 65495 \
>        oversize_dir_length 500 \
>    max_header_length 750 \
>    max_headers 100 \
>    ports { 80 311 591 593 901 1220 1414 1830 2301 2381 2809 3128 3702 5250
> 7001 7777 7779 8000 8008 8028 8080 8088
>  8118 8123 8180 8181 8243 8280 8888 9090 9091 9443 9999 11371 } \
>    non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \
>    enable_cookie \
>    extended_response_inspection \
>    inspect_gzip \
>    normalize_utf \
>    unlimited_decompress \
>    apache_whitespace no \
>    ascii no \
>    bare_byte no \
>    base36 no \
>        directory no \
>        double_decode no \
>        iis_backslash no \
>        iis_delimiter no \
>        iis_unicode no \
>        multi_slash no \
>   utf_8 no \
>        u_encode yes \
>        webroot no
>
> -- Eoin
------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users