[Snort-devel] same content different service, only first rule honored.

Chris Green cmg at ...402...
Wed May 1 17:54:07 EDT 2002


Phil Wood <cpw at ...86...> writes:

> Is this a known problem?
>

Just mailed Mike a different exmaple brian sent me.  Do you get the
same symptoms if you comment out #define PATTERN_FAST in
sp_pattern_match.c?

There's definately something odd going on with pattern matcher and I'm
trying to figure them out.  
>
> for p in 18 19; do id | nc -p $p server 1022;sleep 2; done
>
> Check your logs.  Only the port 18 packet will show up.
>  
> Thanks,
>
> Phil

-- 
Chris Green <cmg at ...81...>
A good pun is its own reword.




More information about the Snort-devel mailing list