Re: http_inspect

[Todd Wease <twease () sourcefire com>]

Hi Sascha,

For your http_inspect default config, don't specify any ports and I
think that should do what you want, e.g.

preprocessor http_inspect_server: server default ports { }


Todd

Sascha Hintz wrote:
> Hi all,
>
> I am setting up my http_inspect preproc. I want to specify only one web 
> server from my network, cause I want http:inspect to analyse only web 
> traffic in this device, and whatever traffic sourced from my lan clients 
> to web internet servers, I do not want http_inspect to generate events.
>
> preprocessor http_inspect: global \
>     iis_unicode_map unicode.map 1252
>
>
> preprocessor http_inspect_server: server 172.22.39.100 profile apache 
> ports { 80 } oversize_dir_length 500
>
> The problem I have is that snort doesnt start if I do not add default 
> config line:
>
> preprocessor http_inspect_server: server default \
>     profile all ports { 80 } oversize_dir_length 500
>
> Adding this line is the only way I have to launch snort, but then I get 
> a lot of events from http_inspect and web traffic from my lan clients to 
> inet.
>
> My version of snort is Version 2.7.0 (Build 35). Is this a bug? Do I 
> always need to include default server configuration?
> Thanks in advance
>
> Sascha


-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users