<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hello Peter,<div><br></div><div>thanks for your reply.</div><div><br></div><div>No this does not work. </div><div><br></div><div>My Useragent: <font color="#008000" style="font-family: Verdana; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">User-Agent:</font><span style="color: rgb(0, 0, 0); font-family: Verdana; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; "> </span><font color="#990000" style="font-family: Verdana; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4</font><span style="color: rgb(0, 0, 0); font-family: Verdana; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; "> </span></div><div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">The rule: alert http any any -> any any (msg:"User-Agent abc http_user_agent"; content:"zilla"; http_user_agent; sid:2; rev:1;)</font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2"><br></font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">What i forgot to mention, suricata does not see the whole traffic. only the incoming requests runs through suricata. </font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">The response of the host goes directly to the client requesting the files (i think this is called direct server return).</font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2"><br></font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">so the pakets flows like this:</font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">- incoming: router -> suricata -> server</font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">- outgoing: server -> router</font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2"><br></font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">There is no way around this as suricata should not be the default gateway for the server.</font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2"><br></font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">Regards</font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2">Michael</font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2"><br></font></div><div style="text-align: -webkit-left;"><font class="Apple-style-span" face="Verdana" size="2"><br></font></div><div><div>Am 23.10.2012 um 22:09 schrieb Peter Manev:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="font-family: monospace; font-size: large; ">alert<span class="Apple-converted-space"> </span><u><b>http</b></u><span class="Apple-converted-space"> </span>any any -> any any (msg:"User-Agent abc http_user_agent"; content:"zilla"; http_user_agent; sid:2; rev:1;)</span></blockquote></div><br></div></body></html>