Re: [Snort-sigs] Snort - problem

You don't have a msg in there. Consult your Snort documentation for the 
"msg" tag..

(Also, I don't think what you're trying to do will work with this rule...)

On 6/12/05, eirinina@in.gr <eirinina@in.gr> wrote:
> Hello,
>
> I have the following problem:
> I use Snort as a NIDS in order to monitor a single host. But I have a 
> problem with HTML POST GET attempts. I want to have an alert every time a 
> password transfers from my host to internal or external network. So, I 
> created a file named "password.rules" and I wrote the following rule:
> alert tcp any any -> any any (content: "password";)
>
> However, this rule doesn't work hence it doesn't catch password attempts. 
> Do you know what's wrong with the rule or where might the problem is?
>
> Thank you,
> Eirini
>
>
>
> -------------------------------------------------------
> This SF.Net <http://SF.Net> email is sponsored by: NEC IT Guy Games. How 
> far can you shotput
> a projector? How fast can you ride your desk chair down the office luge 
> track?
> If you want to score the big prize, get to know the little guy.
> Play to win an NEC 61" plasma display: http://www.necitguy.com/?r
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs