[Snort-devel] Snort 2.8.2.1 Now Available

christian mock cm at ...1206...
Wed Jul 23 11:48:58 EDT 2008


On Tue, Jun 17, 2008 at 04:52:24PM -0400, Snort Releases wrote:

> Snort 2.8.2.1 fixes a problem in which pass rules sometimes did not take 
> precedence over alert and/or drop rules.

I'm still seeing "pass" rules getting ignored with 2.8.2.1. I'm not able
to reproduce it with a minimal (testcase) ruleset, but when I have a 
"normal" (9100 rules) ruleset with a pass rules in front, some of
those are ignored, depending on the amount of pass rules present...

cm.

-- 
Christian Mock                          Wiedner Hauptstr. 15
Senior Security Engineer                1040 Wien
CoreTEC IT Security Solutions GmbH      +43-1-5037273




More information about the Snort-devel mailing list