[Snort-devel] same content different service, only first rule honored.
cpw at ...86...
Thu May 2 10:21:17 EDT 2002
On Wed, May 01, 2002 at 07:47:21PM -0400, Chris Green wrote:
> Phil Wood <cpw at ...86...> writes:
> > Is this a known problem?
> Just mailed Mike a different exmaple brian sent me. Do you get the
> same symptoms if you comment out #define PATTERN_FAST in
Nope, I got both. Oh oh.
> There's definately something odd going on with pattern matcher and I'm
> trying to figure them out.
> > for p in 18 19; do id | nc -p $p server 1022;sleep 2; done
> > Check your logs. Only the port 18 packet will show up.
> > Thanks,
> > Phil
> Chris Green <cmg at ...81...>
> A good pun is its own reword.
Phil Wood, cpw at ...86...
More information about the Snort-devel