[Snort-devel] same content different service, only first rule honored.

Chris Green cmg at ...402...
Wed May 1 17:54:07 EDT 2002

Phil Wood <cpw at ...86...> writes:

> Is this a known problem?

Just mailed Mike a different exmaple brian sent me.  Do you get the
same symptoms if you comment out #define PATTERN_FAST in

There's definately something odd going on with pattern matcher and I'm
trying to figure them out.  
> for p in 18 19; do id | nc -p $p server 1022;sleep 2; done
> Check your logs.  Only the port 18 packet will show up.
> Thanks,
> Phil

Chris Green <cmg at ...81...>
A good pun is its own reword.

More information about the Snort-devel mailing list