El mar, 31 de 08 de 2004 a las 01:43, Jason Haar escribiÃ:
On Mon, Aug 30, 2004 at 06:58:09PM +0000, Abe Use wrote:
I suppose I'll have my users connect through a proxy, and I'll have it
strip or replace the "accept encoding gzip" portion of the header- so that
I can match content plain-text. Would be cool though if snort was able to
inflate the gzip'd stream, and look through the content... or save the
stream and I could use something else to parse through it...
Yes - that feature makes NIDS increasingly useless for Web traffic. Similar
problem to HTTPS - and I think your solution mis similar to how we handle
HTTPS (put in a reverse proxy and sniff the unencrypted side). However
it'll mean you don't get any of the performance benefits of compressed
traffic - which is a pity...
Maybe I'm wrong but you would get the performance benefits of having the
traffic compressed if what you want it's to save bandwidth in your
internet connection, because the 'gunzip' would be done in your local
network, where it shouldn't matter to have more traffic. So the proxy
option could be a good option.
A "uncompressor" preprocessor would be nice - but I have no idea what the
performance impact would be...
It would be very nice.
--
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÃA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"
-------------------------------------------------------
This SF.Net email is sponsored by: thawte's Crypto Challenge Vl
Crack the code and win a Sony DCRHC40 MiniDV Digital Handycam
Camcorder. More prizes in the weekly Lunch Hour Challenge.
Sign up NOW http://ad.doubleclick.net/clk;10740251;10262165;m
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
