[Snort-devel] plugin idea

Sergey Lyubka devnull at ...2232...
Mon Apr 5 02:44:09 EDT 2004


No. I was talking about pre-attack packets.
tag keyword is for post-attack packets.

On Fri, Apr 02, 2004 at 11:17:09AM -0500, Martin Roesch wrote:
> The tag keyword already lets you do that...
> 
> http://www.snort.org/docs/snort_manual/ 
> node16.html#SECTION00375000000000000000
> 
>      -Marty
> 
> On Apr 2, 2004, at 3:21 AM, Sergey Lyubka wrote:




More information about the Snort-devel mailing list