Snort detect file download heaer
The example below shows use of mixed text and binary data in a Snort rule. Note that If enable_cookie is not specified, the cookie still ends up in HTTP header. offset:0; depth:10;) alert tcp any any -> any any(msg:"FILE DATA"; file_data;