[Snort-devel] Double sig-sid

Paul Bakker bakker at ...1546...
Tue Dec 30 07:59:10 EST 2003


Both the:
 - spp_portscan: End of portscan 
 - (spp_stream4) Possible RETRANSMISSION detection

have a sig_sid of 3.

Does this have a reason? Or could it be changed so that sig_sid's are unique....

--------
Paul Bakker




More information about the Snort-devel mailing list