[Snort-devel] Snort 18.104.22.168 Now Available
steve.sturges at ...402...
Wed Jul 23 13:13:31 EDT 2008
Can you send us relevant parts of your configuration?
How are your prioritizing rules? Priority? Use of
-o flag (or other command-line switches)?
When you say "pass rules in front", what do you mean?
christian mock wrote:
> On Tue, Jun 17, 2008 at 04:52:24PM -0400, Snort Releases wrote:
>> Snort 22.214.171.124 fixes a problem in which pass rules sometimes did not take
>> precedence over alert and/or drop rules.
> I'm still seeing "pass" rules getting ignored with 126.96.36.199. I'm not able
> to reproduce it with a minimal (testcase) ruleset, but when I have a
> "normal" (9100 rules) ruleset with a pass rules in front, some of
> those are ignored, depending on the amount of pass rules present...
More information about the Snort-devel