Tim.Saunders at ...2322...
Tue Jan 13 05:08:03 EST 2004
Good, I was wondering about making -Z take a rule order.
When I went looking for the option to change the rule order I found the -o option and I didn't look any further after that. Is the -o option for backwards compatability? If so should/could it be marked depriciated and removed in version 2.5/3 etc.
> -----Original Message-----
> From: Andreas Östling [mailto:andreaso at ...387...]
> Sent: 13 January 2004 12:33
> To: Tim Saunders
> Cc: snort-devel at lists.sourceforge.net
> Subject: Re: [Snort-devel] Patch
> On Tuesday 13 January 2004 10:53, Tim Saunders wrote:
> > The patch adds a -Z command line switch to change the rule
> > order to Pass, Log then Alert. There is not particular
> reason I chose
> > Z so I don't mind if anyone wants to change it.
> In case you're not aware of it, you can already set an
> arbritrary rule order in snort.conf (section 126.96.36.199 in the
> manual). This will do the same thing as
> with -Z with your patch:
> config order: pass activation dynamic log alert
More information about the Snort-devel