Snort mailing list archives
Re: Pass rules need SID in 2.6.1
From: Frank Knobbe <frank () knobbe us>
Date: Sun, 19 Nov 2006 14:58:10 -0600
On Fri, 2006-11-17 at 10:05 -0500, Justin Heath wrote:
It's not just pass rules that require SID. SID's act as a unique identifier for a rule. This is why they are required. Plus it's just good practice.
But only for alert/log output. A SID is not really required for a silent PASS. It wasn't in the past. Any reason it is required now? -Frank -- It is said that the Internet is a public utility. As such, it is best compared to a sewer. A big, fat pipe with a bunch of crap sloshing against your ports.
Attachment:
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Pass rules need SID in 2.6.1 James Lay (Nov 17)
- Re: Pass rules need SID in 2.6.1 Jeff Dell (Nov 17)
- Re: Pass rules need SID in 2.6.1 James Lay (Nov 17)
- Re: Pass rules need SID in 2.6.1 Justin Heath (Nov 17)
- Re: Pass rules need SID in 2.6.1 Frank Knobbe (Nov 19)
- Re: Pass rules need SID in 2.6.1 James Lay (Nov 17)
- Re: Pass rules need SID in 2.6.1 Jeff Dell (Nov 17)