Detect string in the payload

[gnaveen]

Hi,

I want to configure my sensor such that it sends a reset packet if it detect string "ool" in the payload.

Also, the sensor should send the original packet from the attacker included in the alert.

I created a custome signature with STRING.TCP, but it does not seem to work.

Any ideas ??

Thanks,

[mhellman]

Can you provide a little more detail as to how you tested and what you mean by "it does not seem to work".