Re: [Snort-users] Ok, Ok - I know - http_inspect

After I sent out eamil, I tried again this way:

preprocessor http_inspect_server: server default \
profile all ports { 80 8080 8180 } size_dir_length
500 inspect_uri_only

All on one line, and snort runs and showing inspect
uri enabled.

Hope it will work, if not I will try your way below.
But thanks so much!


--- sekure <sekure@gmail.com> wrote:
> You are missing a slash after your unicode
> statement.
> All http_inspect config options want to be part of
> the same line, the
> \ escapes the carriage return. Try this:
>
> preprocessor http_inspect: global \
> iis_unicode_map unicode.map 1252 \ <--- Notice
> that slash
> inspect_uri_only
>
>
>
> On Thu, 17 Jun 2004 12:00:52 -0700 (PDT), Snortty
> <cwcwcwg@yahoo.com> wrote:
> >
> > It's true that one can not specify a subnet, but
> singe
> > IP or global.
> >
> > But, I want to use inspect_uri_only enabled for
> ALL
> > http_inspect alerts, can only make it work if I
> enter
> > an IP address to replace default sever 1.1.1.1.
> >
> > It won't work if I put it like (in snort.conf):
> >
> > preprocessor http_inspect: global \
> > iis_unicode_map unicode.map 1252
> > inspect_uri_only
> >
> > snort won't run, and detect error due to this
> line.
> >
> > Can anyone tell me how to enable this
> >
> > inspect_uri_only
> >
> > for ALL http_inspect alerts (so no such alerts
> will be
> > logged except uricontent inspection please?
> >
> > THANK YOU!
> > Sty
> >
> >
> >
> > --- SN ORT <snort_on_acid@yahoo.com> wrote:
> > > I don't believe you will be able to specify a
> > > subnet.
> > > I tried that awhile ago and couldn't get it to
> work.
> > > It's either global or server-specific.
> > >
> > > Cheese!
> > >
> > > Marc
> > >
> > > --__--__--
> > >
> > > Message: 1
> > > Wrom: ZRCLBDXRQBGJSNBOHMKHJYFMYXOEAIJJPHSCRTNHG
> > > <Krisa.W.Rowland@erdc.usace.army.mil>
> > > To: "'Snort-users@lists.sourceforge.net'"
> > > <Snort-users@lists.sourceforge.net>
> > > Date: Wed, 16 Jun 2004 10:53:56 -0500
> > > Subject: [Snort-users] Ok, Ok - I know -
> > > http_inspect
> > >
> > > This message is in MIME format. Since your mail
> > > reader
> > > does not understand
> > > this format, some or all of this message may not
> be
> > > legible.
> > >
> > > ------_=_NextPart_001_01C453BA.219029D8
> > > Content-Type: text/plain
> > >
> > > I know I'm going to get slaughtered for even
> > > bringing
> > > up the subject of
> > > http_inspect. I've read through the old posts,
> and
> > > also read through the
> > > manual. I'm hoping that someone can offer
> > > clarification or guidance on
> > > this, though. I do not want to disable this
> option
> > > -
> > > but at the moment I'm
> > > going to have to - just pouring out too many
> alerts.
> > >
> > > I tried to limit these alerts to only my webfarm
> > > subnet by doing this:
> > >
> > > preprocessor http_inspect_server: server
> x.x.x.0/8 \
> > > profile all ports { 80 8080 8180 }
> > > oversize_dir_length 500
> > >
> > > But it didn't like that. I'd just like to
> restrict
> > > these alerts to one
> > > subnet - how do I do that?
> > >
> > > Shouldn't I use the all profile if I'm pretty
> sure
> > > that I have apache and
> > > IIS servers?
> > >
> > > Krisa Rowland
> > > <snip>
> > >
> > >
> __________________________________________________
> > > Do You Yahoo!?
> > > Tired of spam? Yahoo! Mail has the best spam
> > > protection around
> > > http://mail.yahoo.com
> > >
> > >
> > >
> >
>
-------------------------------------------------------
> > > This SF.Net email is sponsored by The 2004
> > > JavaOne(SM) Conference
> > > Learn from the experts at JavaOne(SM), Sun's
> > > Worldwide Java Developer
> > > Conference, June 28 - July 1 at the Moscone
> Center
> > > in San Francisco, CA
> > > REGISTER AND SAVE!
> http://java.sun.com/javaone/sf
> > > Priority Code NWMGYKND
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users@lists.sourceforge.net
> > > Go to this URL to change user options or
> > > unsubscribe:
> > >
> >
>
https://lists.sourceforge.net/lists/...fo/snort-users
> > > Snort-users list archive:
> > >
> >
>
http://www.geocrawler.com/redir-sf.p...st=snort-users
> > >
> >
> >
> > __________________________________
> > Do you Yahoo!?
> > Yahoo! Mail Address AutoComplete - You start. We
> finish.
> > http://promotions.yahoo.com/new_mail
> >
> >
> >
> >
> >
>
-------------------------------------------------------
> > This SF.Net email is sponsored by The 2004
> JavaOne(SM) Conference
> > Learn from the experts at JavaOne(SM), Sun's
> Worldwide Java Developer
> > Conference, June 28 - July 1 at the Moscone Center
> in San Francisco, CA
> > REGISTER AND SAVE! http://java.sun.com/javaone/sf
> Priority Code NWMGYKND
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users@lists.sourceforge.net
> > Go to this URL to change user options or
> unsubscribe:
> >
>
https://lists.sourceforge.net/lists/...fo/snort-users
> > Snort-users list archive:
> >
>
http://www.geocrawler.com/redir-sf.p...st=snort-users
> >
>
>
>
-------------------------------------------------------
> This SF.Net email is sponsored by The 2004
> JavaOne(SM) Conference
> Learn from the experts at JavaOne(SM), Sun's
> Worldwide Java Developer
> Conference, June 28 - July 1 at the Moscone Center
> in San Francisco, CA
> REGISTER AND SAVE! http://java.sun.com/javaone/sf
> Priority Code NWMGYKND
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or
> unsubscribe:
>
https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
>
http://www.geocrawler.com/redir-sf.p...st=snort-users
>
=== message truncated ===




__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - Send 10MB messages!
http://promotions.yahoo.com/new_mail


-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users