OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Martin Roesch (roeschsourcefire.com)
Date: Fri Nov 02 2001 - 14:14:19 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    It depends. The uricontent keyword is linked to having the http_decode
    preprocessor turned on (yes, I know it's not orthogonal). Basically, if
    http_decode isn't turned on Snort won't generate the URI data in the
    packet structure and the uricontent keyword will operate exactly as the
    content keyword does. You also need to have your $EXTERNAL_NET set to
    !$HOME_NET if you don't want to catch outbound traffic as well.

    [Original message snipped to halt the flood of email anti-virus systems
    false alarming on the name of the file in question that was part of that
    email. Wow, anti-virus software is lame...]

         -Marty 

    --
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roeschsourcefire.com - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org

    _______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users