SNORT ignoruje content v local.rules

Dobry den.

Prosim Vas ak ma niekto skusenosti so snortom vysvetlite mi nasledujuce veci. Mam bridge lan a v nom eth0 eth1. Spustim snort (ten greb je tam na ...vid dole)

snort -v -I -i lan -de -A fast -c /etc/snort/snort.conf -l /var/log/snort/ -b -p |grep "naked"

v /etc/snort/rules/local.rules su deve pravidla

1. #alert tcp any any -> any any (msg:"TCP traffic";) ak je odremovane vsetky TCP pakety zonaci TCP traffic a toto pravidlo funguje a v /var/log/alert je

02/13-07:30:18.377563 [**] [1:0:0] <lan> TCP traffic [**] [Priority: 0] {TCP} 192.168.10.254:49085 -> 192.168.10.23:22

ale pravidlo

2. alert tcp any any -> any any (content:"naked"; msg:"PORN naked lesbians";) to neloguje nic ani ked to cel negujem ! content: !"naked"

ale cez snort ten paket presiel a obsahoval aj naked vid greb

61 72 63 68 3F 71 3D 6E 61 6B 65 64 2B 26 61 6D arch?q=naked+&am
71 3D 6E 61 6B 65 64 2B 26 69 65 3D 75 74 66 2D q=naked+&ie=utf-

tak nechapem preco to nespustilo alert

Dakujem.

Dotaz: SNORT ignoruje content v local.rules