Home page logo

snort logo Snort mailing list archives

Re: HTTP Inspect with only a GET request.
From: James Lay <digitalx00 () gmail com>
Date: Wed, 22 May 2013 12:09:18 -0600

On May 22, 2013, at 12:03 PM, Joel Esler <jesler () sourcefire com> wrote:

On May 22, 2013, at 1:08 PM, Russ Combs <rcombs () sourcefire com> wrote:
On Wed, May 22, 2013 at 11:27 AM, Shawn Lee <dashawn () gmail com> wrote:
Thanks for the input. That works great on static files. Is there a way to
have this work with snort listening to an interface in IDS mode?

Presently, not without the ACK.

To clarify, this will work if you use "preprocessor normalize_tcp: ips" directive in your snort.conf.

Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager

Will this work even if you're not running IPS mode?  I've always wondered to leave the IPS mode jazz in my config or 
not..thanks Joel.


Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]