Snort mailing list archives
Re: 802.1q Monitoring
From: Chris Green <cmg () sourcefire com>
Date: Fri, 06 Jun 2003 11:20:49 -0400
"Ron Shuck" <rshuck () Buchanan com> writes:
BTW, can you give me any feedback on the problem I see with changing rule order causing some alerts not to fire. I posted a while back. I have had several people tell me they see similar results, but I haven't seen anything in users or devel lists.
Rule ordering is very much under documented in snort 2.0. Lots of changes have been done to the current CVS version to get the rule ordering back. Do you mind trying that out and seeing where that fails you? I see your posts were all about 2.0.0. Thanks, Chris -- Chris Green <cmg () sourcefire com> Laugh and the world laughs with you, snore and you sleep alone. ------------------------------------------------------- This SF.net email is sponsored by: Etnus, makers of TotalView, The best thread debugger on the planet. Designed with thread debugging features you've never dreamed of, try TotalView 6 free at www.etnus.com. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- 802.1q Monitoring Ron Shuck (Jun 05)
- Re: 802.1q Monitoring Bennett Todd (Jun 06)
- Re: 802.1q Monitoring Chris Green (Jun 06)
- Re: 802.1q Monitoring Jeff Nathan (Jun 06)
- Re: 802.1q Monitoring Chris Green (Jun 06)
- Re: 802.1q Monitoring Jeff Nathan (Jun 06)
- <Possible follow-ups>
- RE: 802.1q Monitoring Ron Shuck (Jun 06)
- Re: 802.1q Monitoring Chris Green (Jun 06)
- Re: 802.1q Monitoring Bennett Todd (Jun 06)