Snort mailing list archives
Re: Question about snort rules
From: Joel Esler <jesler () sourcefire com>
Date: Mon, 7 Oct 2013 19:22:51 -0400
If you are asking if it's possible to only trigger after a certain amount of events happen, yes, it's possible to do that with rate filtering. Sent from my iPhone
On Oct 7, 2013, at 6:27 PM, Fernando Villegas <fava.007 () gmail com> wrote: Hi, I need to know if is possible to create rules with conditionality temporary or quantity. For example, "if I receive more than one package 'A' in less than 5 seconds" or "if I receive more than 10 packages 'A' to so ..." I'll wait your answer, thank you for your time. regards! -- Atentamente, Fernando Antonio Villegas Acevedo Estudiante IngenierÃa Civil en Informática y Telecomunicaciones Universidad Diego Portales
------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Question about snort rules Fernando Villegas (Oct 07)
- Re: Question about snort rules Joel Esler (Oct 07)
- Re: Question about snort rules Joel Esler (Oct 07)
- <Possible follow-ups>
- Question about snort rules Fernando Villegas Acevedo (Oct 11)
- Fwd: Question about snort rules Fernando Villegas Acevedo (Oct 11)
- Re: Question about snort rules Joel Esler (Oct 07)