http_inspect

["Sascha Hintz" <sascha.hintz () gmx net>]

Hi all,

I am setting up my http_inspect preproc. I want to specify only one web 
server from my network, cause I want http:inspect to analyse only web 
traffic in this device, and whatever traffic sourced from my lan clients 
to web internet servers, I do not want http_inspect to generate events.

preprocessor http_inspect: global \
    iis_unicode_map unicode.map 1252


preprocessor http_inspect_server: server 172.22.39.100 profile apache 
ports { 80 } oversize_dir_length 500

The problem I have is that snort doesnt start if I do not add default 
config line:

preprocessor http_inspect_server: server default \
    profile all ports { 80 } oversize_dir_length 500

Adding this line is the only way I have to launch snort, but then I get 
a lot of events from http_inspect and web traffic from my lan clients to 
inet.

My version of snort is Version 2.7.0 (Build 35). Is this a bug? Do I 
always need to include default server configuration?
Thanks in advance

Sascha
-- 
Psssst! Schon das coole Video vom GMX MultiMessenger gesehen?
Der Eine für Alle: http://www.gmx.net/de/go/messenger03

-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users