Re: Making snort smarter...

[Jason Haar <Jason.Haar () trimble co nz>]

Paul Schmehl wrote:
> For the specific example you give I think it would be entirely 
> appropriate to create a var called "$IIS_SERVERS" and then put all the 
> *other* webservers under $HTTP_SERVERS.  I've suggested this before, and 
> I'd love to see it implemented in the rules, because IIS is a beast unto 
> itself.

Good idea - but as all IIS rules are within web-iis.rules, why not just 
script a rewrite?

echo "var IIS_SERVERS [1.2.3.4/32,2.3.4.1/32]"
sed 's/HTTP_SERVERS/IIS_SERVERS/g' web-iis.rules


Jason



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users