[Snort-devel] new pb on snort v2 ? (icmp large packet)

Chris Green cmg at ...402...
Wed Apr 23 10:31:06 EDT 2003


rmkml <rmkml at ...1042...> writes:

> but how to make then ?
> (for look icmp large packet event on snort v2)
>

Currently, create a different rule with dsize + itype for it or
disable the icmp-info rules.
-- 
Chris Green <cmg at ...402...>
This is my signature. There are many like it but this one is mine.




More information about the Snort-devel mailing list