[Snort-devel] Patch

Tim Saunders Tim.Saunders at ...2322...
Tue Jan 13 05:08:03 EST 2004


Good, I was wondering about making -Z take a rule order.

When I went looking for the option to change the rule order I found the -o option and I didn't look any further after that. Is the -o option for backwards compatability? If so should/could it be marked depriciated and removed in version 2.5/3 etc.

Tim

> -----Original Message-----
> From: Andreas Östling [mailto:andreaso at ...387...] 
> Sent: 13 January 2004 12:33
> To: Tim Saunders
> Cc: snort-devel at lists.sourceforge.net
> Subject: Re: [Snort-devel] Patch
> 
> 
> 
> On Tuesday 13 January 2004 10:53, Tim Saunders wrote:
> 
> > The patch adds a -Z command line switch to change the rule 
> application 
> > order to Pass, Log then Alert. There is not particular 
> reason I chose 
> > Z so I don't mind if anyone wants to change it.
> ...
> 
> In case you're not aware of it, you can already set an 
> arbritrary rule order in snort.conf (section 2.1.3.2 in the 
> manual). This will do the same thing as 
> with -Z with your patch:
> config order: pass activation dynamic log alert
> 
> /Andreas
> 
> 




More information about the Snort-devel mailing list