RE: Test question

[Ryan Hill <rhill () xypoint com>]

Ronneil,
 
If you don't change the rule processing order (snort -o), then AFAIK, the
alert will trigger irregardless of the pass rule since alert rules will be
processed first in the engine.  Generally, if you've written any pass rules,
you want to use snort -o to utilize them.  The default option is not using
them (probably for performance reasons - one can speculate).
 
BTW: Good suggestions Phil.  I'm getting double triggers as the messages
pass over two sensors before reaching me... lol
 
<snip false alarm generating sig here>
 
Regards,


Ryan Hill, MCSE
IT Ninja 
Corporate Information Systems 
TeleCommunication Systems, Inc. (TCS) - http://www.telecomsys.com
<http://www.telecomsys.com/>  
v: 206.792.2276 - f: 206.792.2001 
pgp: 0x17CE70AB 

-----Original Message-----
From: Ronneil Camara [mailto:ronneilc () remingtonltd com] 
Sent: Monday, December 17, 2001 12:57 PM
To: Ryan Hill
Cc: snort-users () lists sourceforge net
Subject: RE: [Snort-users] Test question


Thanks Ryan,
 
I'll try that one. So if I didn't use -o, then the new rule must come before
the alert, am I right?