[Snort-inline-users] Question SMTP Rules

[ismain <ism...@ya...>]

Hello 
 
can you please tell me what I do wrong. 
I hereby would like block email message because of the content in Subject.
 
drop tcp  $EXTERNAL_NET any -> SMTP_SERVERS 25 (msg:"WORD  GO ";flow:to_server,established;content:"Subject|3A|";nocase;pcre:"/GO/i";sind1001004;rev:1;)
 
 
thanks


      _____________________________________________________________________________ 
Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr