Snort mailing list archives
Re: Reputation preproc priority showing "blacklist" when set to "whitelist"
From: Mike Cox <mike.cox52 () gmail com>
Date: Wed, 29 Jul 2015 08:30:40 -0400
Ah, OK, thanks. I had whitelist set to unblack. -MIke Cox On Tue, Jul 28, 2015 at 1:54 PM, Hui cao <huica () cisco com> wrote:
Hi Mike, Thanks for reporting this. This is an output issue. It only outputs whitelist when whitelist means trust. When it means unblack, it outputs blacklist. It should output whitelist in both cases. Best, Hui. On 07/28/2015 01:27 PM, Mike Cox wrote: When enabling the reputation preprocessor and not setting the "priority" option, I see this (the default value) when Snort starts up: Reputation config: ... Reputation priority: whitelist However, if I set the "priority" option to "whitelist" (it can only be set to "whitelist" or "blacklist"), I get this when Snort starts up: Reputation config: ... Reputation priority: blacklist I have not tested to see if this is just an output issue or if it actually affects engine behaviour. However, I see this on Snort 2.9.7.3 and also now on Snort 2.9.7.5, as well as previous versions. Thanks. -Mike Cox ------------------------------------------------------------------------------ _______________________________________________ Snort-devel mailing listSnort-devel@lists.sourceforge.nethttps://lists.sourceforge.net/lists/listinfo/snort-devel Archive:http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort! ------------------------------------------------------------------------------ _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Reputation preproc priority showing "blacklist" when set to "whitelist" Mike Cox (Jul 28)
- Re: Reputation preproc priority showing "blacklist" when set to "whitelist" Hui cao (Jul 28)
- Re: Reputation preproc priority showing "blacklist" when set to "whitelist" Mike Cox (Jul 29)
- Re: Reputation preproc priority showing "blacklist" when set to "whitelist" Hui cao (Jul 28)