Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi I have snort rules to alert for specific host name and URL. when I tested I see that snort is not alerting if I use internet explorer 8, but alerting if i use firefox and safari after analysis , i found that "Host" field is in bottom of request in case of IE8 , and its on top in other browsers. My config file has

preprocessor http_inspect_server: server default \ profile all \ ports { 80 8080 8001 } \ flow_depth -1 \ no_alerts

.it may be possibel that due to large GET header in IE, it is split into multiple pkts. I suspect that snort is not scanning all pkts of header is it limitation? I am only interested in parsing HTTP GETs so does flow_depth 0 help? I am not nitersted in HTTP response fields

also what cfg change i need to make so that http_inspect looks in multiple pkts (of a large GET)?

should i add anything in my conf file or add anything to http_inspect?

thanks for help in advance

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.