OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Andreas Östling (andreaso_at_it.su.se)
Date: Thu Oct 31 2002 - 02:53:27 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Wednesday 30 October 2002 02.28, larosa, vjay wrote:
    ...
    > Shouldn't both of these rules work, (with the first one being more
    > accurate)? Or am I interpreting the uricontent
    > keyword incorrectly?

    This may be a stupid question, but are you sure you loaded the http_decode
    preprocessor and that you don't get any error message from it on startup?
    Uricontent will not work without it.

    Both your rules works for me.

    /Andreas

    -------------------------------------------------------
    This sf.net email is sponsored by: Influence the future
    of Java(TM) technology. Join the Java Community
    Process(SM) (JCP(SM)) program now.
    http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0004en
    _______________________________________________
    Snort-users mailing list
    Snort-userslists.sourceforge.net
    Go to this URL to change user options or unsubscribe:
    https://lists.sourceforge.net/lists/listinfo/snort-users
    Snort-users list archive:
    http://www.geocrawler.com/redir-sf.php3?list=snort-users