0

i'm using snort since some weeks now and today i want to use it in order to trigger alert for some content in the case of HTTP requests. So i try a simple rule like this one in order to begin..

alert tcp any any -> any any (msg:"TRIGGERED"; sid:1000001; content:".com"; http_uri;)

In any case, my rule where trigger while i navigate on the internet. So i try something simpler

alert tcp any any -> any any (msg:"TRIGGERED"; sid:1000001; content:"POST";)

alert tcp any any -> any any (msg:"TRIGGERED"; sid:1000001; content:"GET";)

Nothing was trigger too... I'm a bit disappointed, is anyone have a clue? I also tried some rules in order to find an HTTP POST parameter without sucess with this kind of rule:

alert tcp any any -> any any (msg:"TRIGGERED"; sid:1000001; pcre:"/login.*/";)

Note: I use snort version 2.9

  • I'm not a Snort expert, but the rules look syntactically correct. Verify that they are actually specified to be imported by your config file. sudo snort -T -i eth0 -c /etc/snort/snort.conf (substituting as necessary for eth0) and check your rules. – user10216038 Apr 27 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.