Re: [Snort-devel] Snort not detecting some rules

Your problem is with web rules that look for content in HTTP server response payloads. This is because the http_inspect preprocessor, and previously the httpflow preprocessor, processes the HTTP response headers and ignores most of the response payload. We do this for performance reasons since we only have a few rules (excluding the 10 or so in porn) that actually even look at the response payload.

Try adding flow_depth 0 (which turns on complete http response inspection) to the end your "http_inspect: server default" line.

Dan

On Thu, 2004-03-18 at 12:22, Ian S. Nelson wrote:
>
> I've been kicking this around with snort 2.1. I've got streams of data

-- 
Daniel Roelker
Software Developer
Sourcefire, Inc.



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.
http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel