[Snort-sigs] Snort - problem

Hello, 

I installed Snort in a workstation in order to capture abnormal activities, 
such as outcoming uncrupted information.  

I type: 

snort -den -l ../log -h xxx.xxx.xxx.xxx./32 -c ../etc/snort/conf 

in order to enable NIDS mode and I made a file name find.rules with the 
following rule: 

alert tcp any any -> any any (msg:"Content test found"; content:"test";) 

The problem is that Snort generates alerts only for incoming packets that 
contain the 
word "test". I care about the outcoming packets. What should I change? 

I also installed a apache web server and I captured packets from external 
network 
to server. But, I want exactly the opposite. To capture outcoming packets from 
the 
workstation to the external network. 

(I am trying to do all the above because I want to protect the workstation from 
social engineering attacks. Is this feasible???) 

If the above cannot be done, should I install Snort in a switch? 

Thank you, 
Eirini


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&opΜk
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs