[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-users
Subject:    [Snort-users] no alerts on the dos screen
From:       mary andrews <maryandrews22 () gmail ! com>
Date:       2009-11-17 19:04:07
Message-ID: e60ccb1c0911171104h379b222dp7e6b10d27a9dce27 () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


# testing.rules
alert icmp any any -> any any (msg:"$$$$$TESTING rule$$$$$"; sid:1000001;)
alert tcp any any -> any any (msg:"test ebay rule";
flow:to_server,established; content:"ebay.com"; nocase; sid:10000002;
rev:1;)
--------

See, if we ping any  host, we get the $$$$$TESTING rule$$$$$  message on the
dos screen.

But if we visit www.ebay.com from our browser, we dont get to see any alerts
on the dos screen.


please, very please?

thanks,
m

[Attachment #5 (text/html)]

<p># testing.rules</p>
<div>alert icmp any any -&gt; any any (msg:&quot;$$$$$TESTING rule$$$$$&quot;; \
sid:1000001;)<br></div> <div>alert tcp any any -&gt; any any (msg:&quot;test ebay \
rule&quot;; flow:to_server,established; content:&quot;<a \
href="http://ebay.com">ebay.com</a>&quot;; nocase; sid:10000002; rev:1;)<br></div> \
<div>--------</div> <div> </div>
<div>See, if we ping any  host, we get the $$$$$TESTING rule$$$$$  message on the dos \
screen. </div> <div> </div>
<div>But if we visit <a href="http://www.ebay.com/">www.ebay.com</a> from our \
browser, we dont get to see any alerts on the dos screen.</div> <div> </div>
<div> </div>
<div>please, very please?</div>
<div> </div>
<div>thanks, </div>
<div>m</div>



------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

[prev in list] [next in list] [prev in thread] [next in thread]