Raymond Dijkxhoorn wrote:
Hi!
full PROLO_REDIR_ZDNET_CHECK_1 /http://.*chkpt.zdnet.com/chkpt/ score PROLO_REDIR_ZDNET_CHECK_1 8.0 describe PROLO_REDIR_ZDNET_CHECK_1 PROLO_REDIR-ZDNET CHECK_1_2_3, Body
Your rule above, using uri instead of full, works under both 3.0 and 3.1 (and probably older versions).
So how would it look like? I have no problem replacing it with a less CPU exhausting model ;)
The exact same regex above would work as a uri test. Though, you might want to use:
uri PROLO_REDIR_ZDNET_CHECK_1 /^http://.*chkpt.zdnet.com/chkpt/
...and to more closely match the zdnet redirector...
uri PROLO_REDIR_ZDNET_CHECK1 /^http://chkpt.zdnet.com/chkpt//
Daryl