[Snort-devel] New feature wanted: Locate the bad guy?

Gianni Tedesco gianni at ...1804...
Sun Jul 6 09:26:10 EDT 2003


On Sun, 2003-07-06 at 17:16, Brian wrote:
> On Fri, Jul 04, 2003 at 11:28:10AM +0100, Gianni Tedesco wrote:
> > would work for most things. Then for sigs like 'id check returns root'
> > the rule is:
> > 
> > $EXTERNAL_NET <- $HOME_NET
> 
> Yeah, except <- support has been removed.

Silly me, it's obviously impossible. :)

-- 
// Gianni Tedesco (gianni at scaramanga dot co dot uk)
lynx --source www.scaramanga.co.uk/gianni-at-ecsc.asc | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20030706/e0efa857/attachment.sig>


More information about the Snort-devel mailing list