Snort mailing list archives
Re: Setting Snort policy_mode
From: Ricky Huang <rhuang.work () gmail com>
Date: Tue, 5 Mar 2013 17:25:35 -0800
On Mar 5, 2013, at 4:04 PM, Ricky Huang <rhuang.work () gmail com> wrote:
[…] While I understand how to start snort by hand and passing in -Q or --enable-inline-test, I would like to use /etc/rc.d/ script to start up Snort on boot up. Do I add config policy_mode:(inline | tap | inline_test) in the snort.conf file? Do I have to modify the rc.d script to add in the command line arguments? Or…?
Upon further reading I found the answer to my question here: http://manual.snort.org/node16.html#SECTION00313100000000000000 policy_mode is added to snort.conf. I have a follow-up question, the config file provided by snort.org contains no such key/field (http://labs.snort.org/snort/2940/snort.conf), does it by default start in "tap" mode? (I am guessing it does…).
------------------------------------------------------------------------------ Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the endpoint security space. For insight on selecting the right partner to tackle endpoint security challenges, access the full report. http://p.sf.net/sfu/symantec-dev2dev
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Setting Snort policy_mode Ricky Huang (Mar 05)
- Re: Setting Snort policy_mode Ricky Huang (Mar 05)