Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to snort rules and need a rule that will alert any email from a specific user.. For example:

alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; fast_pattern:only; nocase; classtype: Target Email Detected ;sid:12345 ;)

This rule as of now will sniff it if it is in the content, but mail from the email above is not alerted, thanks in advance.

share|improve this question

migrated from stackoverflow.com Oct 18 '11 at 15:55

This question came from our site for professional and enthusiast programmers.

Probably not relevant to StackOverflow but shouldn't be down voated. –  R0MANARMY Oct 18 '11 at 13:47
I figure someone would maybe know how to do it here I looked online already –  ThatGuy Oct 18 '11 at 14:22
No worries, you could wait for it to be migrated or just delete it and re-post it there. –  R0MANARMY Oct 18 '11 at 14:27
Where would I repost it at? –  ThatGuy Oct 18 '11 at 14:36
Oohh....that probably helps =). Super User, one of the sister sites, but geared towards technical though not specifically programming related questions. –  R0MANARMY Oct 18 '11 at 14:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.