Snort mailing list archives
Snort pass rules...
From: PlanAlpha <plan.alpha () gmail com>
Date: Tue, 24 May 2005 11:27:32 -0700
Greetings- I'm having a problem with a couple of pass rules. Usually I get false alert (in BASE), look at the sid=n, grep for the rule, paste it into my local.rules and change alert to pass and alter the src/dst, etc.... But I'm getting some alerts on sid's without rules, like sid=2 or sid=7. I assume these are from one or more of my plugins. How do I add them to my local.rules or mimic that function? Many thanks! ------------------------------------------------------- This SF.Net email is sponsored by Yahoo. Introducing Yahoo! Search Developer Network - Create apps using Yahoo! Search APIs Find out how you can build Yahoo! directly into your own Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort pass rules... PlanAlpha (May 24)
- Re: Snort pass rules... Matt Kettler (May 24)