Blocking gzip HTTP content with Iptables or Snort?

Question

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?

Answer 1

snort knows how to handle compressed HTTP requests and responses. So configuring snort in inline mode and writing rules with file_data before the content keyword would do it.