Re: [Snort-users] Ok, Ok - I know - http_inspect

You are missing a slash after your unicode statement.
All http_inspect config options want to be part of the same line, the
\ escapes the carriage return. Try this:

preprocessor http_inspect: global \
iis_unicode_map unicode.map 1252 \ <--- Notice that slash
inspect_uri_only



On Thu, 17 Jun 2004 12:00:52 -0700 (PDT), Snortty <cwcwcwg@yahoo.com> wrote:
>
> It's true that one can not specify a subnet, but singe
> IP or global.
>
> But, I want to use inspect_uri_only enabled for ALL
> http_inspect alerts, can only make it work if I enter
> an IP address to replace default sever 1.1.1.1.
>
> It won't work if I put it like (in snort.conf):
>
> preprocessor http_inspect: global \
> iis_unicode_map unicode.map 1252
> inspect_uri_only
>
> snort won't run, and detect error due to this line.
>
> Can anyone tell me how to enable this
>
> inspect_uri_only
>
> for ALL http_inspect alerts (so no such alerts will be
> logged except uricontent inspection please?
>
> THANK YOU!
> Sty
>
>
>
> --- SN ORT <snort_on_acid@yahoo.com> wrote:
> > I don't believe you will be able to specify a
> > subnet.
> > I tried that awhile ago and couldn't get it to work.
> > It's either global or server-specific.
> >
> > Cheese!
> >
> > Marc
> >
> > --__--__--
> >
> > Message: 1
> > Wrom: WFAOBUZXUWLSZLKBRNVWWCUFPEGAUTFJMVRESKPNK
> > <Krisa.W.Rowland@erdc.usace.army.mil>
> > To: "'Snort-users@lists.sourceforge.net'"
> > <Snort-users@lists.sourceforge.net>
> > Date: Wed, 16 Jun 2004 10:53:56 -0500
> > Subject: [Snort-users] Ok, Ok - I know -
> > http_inspect
> >
> > This message is in MIME format. Since your mail
> > reader
> > does not understand
> > this format, some or all of this message may not be
> > legible.
> >
> > ------_=_NextPart_001_01C453BA.219029D8
> > Content-Type: text/plain
> >
> > I know I'm going to get slaughtered for even
> > bringing
> > up the subject of
> > http_inspect. I've read through the old posts, and
> > also read through the
> > manual. I'm hoping that someone can offer
> > clarification or guidance on
> > this, though. I do not want to disable this option
> > -
> > but at the moment I'm
> > going to have to - just pouring out too many alerts.
> >
> > I tried to limit these alerts to only my webfarm
> > subnet by doing this:
> >
> > preprocessor http_inspect_server: server x.x.x.0/8 \
> > profile all ports { 80 8080 8180 }
> > oversize_dir_length 500
> >
> > But it didn't like that. I'd just like to restrict
> > these alerts to one
> > subnet - how do I do that?
> >
> > Shouldn't I use the all profile if I'm pretty sure
> > that I have apache and
> > IIS servers?
> >
> > Krisa Rowland
> > <snip>
> >
> > __________________________________________________
> > Do You Yahoo!?
> > Tired of spam? Yahoo! Mail has the best spam
> > protection around
> > http://mail.yahoo.com
> >
> >
> >
> -------------------------------------------------------
> > This SF.Net email is sponsored by The 2004
> > JavaOne(SM) Conference
> > Learn from the experts at JavaOne(SM), Sun's
> > Worldwide Java Developer
> > Conference, June 28 - July 1 at the Moscone Center
> > in San Francisco, CA
> > REGISTER AND SAVE! http://java.sun.com/javaone/sf
> > Priority Code NWMGYKND
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users@lists.sourceforge.net
> > Go to this URL to change user options or
> > unsubscribe:
> >
> https://lists.sourceforge.net/lists/...fo/snort-users
> > Snort-users list archive:
> >
> http://www.geocrawler.com/redir-sf.p...st=snort-users
> >
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail Address AutoComplete - You start. We finish.
> http://promotions.yahoo.com/new_mail
>
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
> Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
> Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
> REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users
>


-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users