[Snort-devel] Suggestion for unknown keywords

Brian bmc at ...835...
Wed Jan 29 09:21:05 EST 2003


On Wed, Jan 29, 2003 at 01:02:32AM -0600, Frank Knobbe wrote:
> In light of the fact that the Snort Stable rules are outdated in CVS and
> tar ball, and only the current rules are maintained well, I would like
> to suggest the following:
> 
> Have Snort IGNORE unknown keywords in the Snort rules.

nooooooooooooooooooooooooooooooooooooo.

If snort ignored the entire RULE, then maybe, but ignoring an option is
bad.  You would get a ton of false positives.

-brian




More information about the Snort-devel mailing list