RE: [Snort-inline-users] uricontent matching v2

[Rob M. <ro...@ho...>]

> Alright, so heres the deal, I did get uricontent matching to work under
> snort_inline-2.1.1, I had to enable stream 4 reassembly for both the
> client
> and server connections.  The http_inspect preprocessor does not do any
> stream reassembly and will not match on any rules if stream 4 is not
> enabled.  Here are the changes I had to make in my snort_inline.conf file
>
> preprocessor stream4_reassemble: both
>
> preprocessor http_inspect: global \
>     iis_unicode_map unicode.map 1252
>
> preprocessor http_inspect_server: server default \
>     profile all ports { 80 8080 8180 } oversize_dir_length 500
>
> Regards,

Excellent!  Thanks for working this!  Will make this part of the default
snort_inline.conf for snort_inline-2.1.2

Rob