Snort mailing list archives
Pass rule help
From: "Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>
Date: Wed, 20 Jun 2001 15:30:38 -0400
This is my first attempt at writing a pass rule so I thought I would post a message for a tip or two. Occasionally I send emails directly from my Snort server which tends to set off alarms. I want to pass all mail traffic from the snort server to the mail server with a rule such as: pass snortserver any -> mailserver 25 My questions are as follows: 1. What rules file to place this pass statement in 2. Where in the rules file should it be placed (before or after the alert statements) 3. Does it matter where or in what order I place this rules file in snort.conf? Thanks for helping us newbies out! Paul _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Pass rule help Sheahan, Paul (PCLN-NW) (Jun 20)