mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
16 lines
641 B
Plaintext
16 lines
641 B
Plaintext
accept:packet arp:all any any -> any any (alert; sid:200;)
|
|
|
|
# allow session setup
|
|
accept:hook tcp:all any any <> any 80 (flow:not_established; alert; sid:1021;)
|
|
|
|
# pass rest of the flow to
|
|
accept:hook tcp:all any any <> any 80 (flow:established; alert; sid:1023;)
|
|
#accept:hook ip:all any any <> any any (alert; sid:1024;)
|
|
|
|
# default drop
|
|
|
|
accept:hook http1:request_started any any -> any any (alert; sid:100;)
|
|
accept:hook http1:request_line any any -> any any (http.method; content:"GET"; http.uri; content:"/"; alert; sid:101;)
|
|
accept:tx http1:request_headers any any -> any any (http.user_agent; content:"wget"; nocase; alert; sid:102;)
|
|
|