Snort mailing list archives

Re: About using reject in pulledpork


From: JJC <cummingsj () gmail com>
Date: Mon, 4 Apr 2011 16:01:49 -0600

It is certainly possible.. the reason that I say you are doing it wrong is
simply because the actual other functions to modify (drop, enable, or
disable) are much more efficient.  Having said that, you can absolutely use
modifysid to change to reject!

JJC

On Mon, Apr 4, 2011 at 3:29 PM, carlopmart <carlopmart () gmail com> wrote:

On 04/02/2011 12:22 AM, carlopmart wrote:
Hi all,

Is it possible to use "reject" instead of "drop" on some signatures?? I
have read modifysid.conf but says explicit "If you are attempting to
change rulestate (enable,drop,disable) from here then you are doing it
wrong, it is much more efficient to do so from within the respective
rulestate modification configuration files"

Thanks.

JJC, could this be possible??

Thanks.

--
CL Martinez
carlopmart {at} gmail {d0t} com


------------------------------------------------------------------------------
Xperia(TM) PLAY
It's a major breakthrough. An authentic gaming
smartphone on the nation's most reliable network.
And it wants your games.
http://p.sf.net/sfu/verizon-sfdev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Xperia(TM) PLAY
It's a major breakthrough. An authentic gaming
smartphone on the nation's most reliable network.
And it wants your games.
http://p.sf.net/sfu/verizon-sfdev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: