I am trying to detect a string in HTML (already unzipped) with Snort. I set this rule to find content
7038685658 in my Apache web server's HTML:
alert tcp any any <> any any (msg:"cell"; file_data; content:"7038685658"; sid:9000001)
This is the location where the content is:
But I can not detect any alert from Snort. What am I doing wrong?