[Snort-devel] Patch

Andreas Östling andreaso at ...387...
Tue Jan 13 04:34:00 EST 2004


On Tuesday 13 January 2004 10:53, Tim Saunders wrote:

> The patch adds a -Z command line switch to change the rule application
> order to Pass, Log then Alert. There is not particular reason I chose Z
> so I don't mind if anyone wants to change it.
...

In case you're not aware of it, you can already set an arbritrary rule order
in snort.conf (section 2.1.3.2 in the manual). This will do the same thing as 
with -Z with your patch:
config order: pass activation dynamic log alert

/Andreas





More information about the Snort-devel mailing list