[Snort-devel] same content different service, only first rule honored.

Phil Wood cpw at ...86...
Thu May 2 10:21:17 EDT 2002


On Wed, May 01, 2002 at 07:47:21PM -0400, Chris Green wrote:
> Phil Wood <cpw at ...86...> writes:
> 
> > Is this a known problem?
> >
> 
> Just mailed Mike a different exmaple brian sent me.  Do you get the
> same symptoms if you comment out #define PATTERN_FAST in
> sp_pattern_match.c?

Nope, I got both.  Oh oh.

> 
> There's definately something odd going on with pattern matcher and I'm
> trying to figure them out.  
> >
> > for p in 18 19; do id | nc -p $p server 1022;sleep 2; done
> >
> > Check your logs.  Only the port 18 packet will show up.
> >  
> > Thanks,
> >
> > Phil
> 
> -- 
> Chris Green <cmg at ...81...>
> A good pun is its own reword.

-- 
Phil Wood, cpw at ...86...





More information about the Snort-devel mailing list