From: Eoin Miller (eoin.millertrojanedbinaries.com)
Date: Thu Aug 19 2010 - 17:37:54 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

  So if a rule has an http_* keyword (http_uri, http_client_body,
http_method) but the snort configuration does not allow the use of it
because it is missing in the http_inspect configuration section, why
does the rule choose to match and fire for that content that is using
that keyword modifier?

-- Eoin

------------------------------------------------------------------------------
This SF.net email is sponsored by

Make an app they can't live without
Enter the BlackBerry Developer Challenge
http://p.sf.net/sfu/RIM-dev2dev
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]