[Snort-devel] time range options for rules

Federico Castañeda F_CASTANEDA at ...2487...
Wed Apr 21 15:38:03 EDT 2004


Hi,

There is any planned modification in rules options to include time range
validation? For example, if I want to write a rule for a period of time, and
include something like:

valid_from: "2004-04-19"; valid_to: "2004-05-01";

When snort receive the packet it check the packet time with the range and
ignore or process the rule. I think this could be useful for rules debugging
or to follow recommendations that you make to net admins.

Please let me know if you thing that is a stupid suggestion or if it's
reasonable to develop.

Thanks in advance,

Best Regards,

Federico.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20040421/0c136502/attachment.html>


More information about the Snort-devel mailing list