|
|
|
|
Snort Forums Archive
Archive Home » Rules » content filtering
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
content filtering
Posted by vvinod1 on March 24, 2005 21:09:40
Hi.. can any one help me about how to configure snort to alert if a specific content, i.e., for eg: "resume" is passing through mails both outgoing & incoming mails..
thanx
V.Vinod. |
|
Posted by novowels on March 26, 2005 12:17:47
You need to write a rule for this. The snort manual has a chapter on writing rules and there are some good books that cover the topic.
an example might be
alert tcp $SMTP_SERVERS 25 <> any any (msg:"LOCAL - resume in mail"; content:"resume"; nocase; sid:1000000; rev:1)
You could also look into the Training offered by Sourcefire on the Snort detection engine. |
|
Posted by julesd on April 14, 2005 04:53:18
Yeah, get the snort training or die.
JD |
|
|
|
|
|
