Re: uricontent misbehaving?

[Martin Roesch <roesch () sourcefire com>]

It depends.  The uricontent keyword is linked to having the http_decode
preprocessor turned on (yes, I know it's not orthogonal).  Basically, if
http_decode isn't turned on Snort won't generate the URI data in the
packet structure and the uricontent keyword will operate exactly as the
content keyword does.  You also need to have your $EXTERNAL_NET set to
!$HOME_NET if you don't want to catch outbound traffic as well.

[Original message snipped to halt the flood of email anti-virus systems
false alarming on the name of the file in question that was part of that
email.  Wow, anti-virus software is lame...]

     -Marty


--
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch () sourcefire com - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users