I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
I am just getting started with learning and testing snort. I have some snort data in snort.u2.timestamp files. What is the best way to view / read these files? I have found some info via Google ...
I have a problem installing Snort on CentOS 6.3 in a virtual environment. When I run snort - ./snort status: Running in packet dump mode --== Initializing Snort ==-- Initializing Output ...