Snort mailing list archives
Re: Re: (Snort-users) Disabling rules without touching the origi
From: Marcus Spading <linuxnews () fragmentum net>
Date: Thu, 3 Jan 2002 08:03:54 +0100
* sandro.poppi () wacker com <sandro.poppi () wacker com> [020103 07:36]:
did you already try using pass rules? This helped me (and of course a lot of others too ;). Adding the command line option -o is then required. For your
Yes I already tried that one. It seemed to work, but ...
For more information take a look on the excellent snort manual.
.. after reading the manual a third time, I decided it is safer not to use the -o option, especially because I am relativly new to snort and I don't want a bad crafted pass rule to throw away important alerts that otherwise would have been logged. -- BCNU Marcus _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- AW: (Snort-users) Disabling rules without touching the origi sandro.poppi (Jan 02)
- Re: Re: (Snort-users) Disabling rules without touching the origi Marcus Spading (Jan 02)