CODEWITHSUNDEEP
snort
Tri
Tri

Reputation: 3039

Snort Rule to detect http, https and email

I configured the snort rule to detect ping and tcp

alert icmp any any -> any any (msg:"ping";sid:10000001;rev:0;)

How do I configure the snort rule to detect http, https and email?

Upvotes: 1

Views: 13142

Answers (1)

Dalya
Dalya

Reputation: 404

Snort rule to detect http:

alert tcp any any -> any 80 (content:"HTTP"; msg:"http test"; sid:10000100; rev:005;)

Snort rule to detect https:

alert tcp any any -> any 443 (content:"HTTPS"; msg:"https test"; sid:10000101; rev:006;)

Upvotes: 5

Related Questions