[Snort-devel] New feature wanted: Locate the bad guy?

Brian bmc at ...835...
Sun Jul 6 09:17:14 EDT 2003


On Fri, Jul 04, 2003 at 11:28:10AM +0100, Gianni Tedesco wrote:
> would work for most things. Then for sigs like 'id check returns root'
> the rule is:
> 
> $EXTERNAL_NET <- $HOME_NET

Yeah, except <- support has been removed.

-brian




More information about the Snort-devel mailing list