[Snort-devel] Reputation preproc priority showing "blacklist" when set to "whitelist"

Hui cao huica at ...3461...
Tue Jul 28 13:54:37 EDT 2015


Hi Mike,

Thanks for reporting this. This is an output issue. It only outputs 
whitelist when whitelist means trust. When it means unblack, it outputs 
blacklist. It should output whitelist in both cases.

Best,
Hui.

On 07/28/2015 01:27 PM, Mike Cox wrote:
> When enabling the reputation preprocessor and not setting the 
> "priority" option, I see this (the default value) when Snort starts up:
>
> Reputation config:
>    ...
>    Reputation priority:  whitelist
>
> However, if I set the "priority" option to "whitelist" (it can only be set to "whitelist" or "blacklist"), I get this when Snort starts up:
>
> Reputation config:
>    ...
>    Reputation priority:  blacklist
>
> I have not tested to see if this is just an output issue or if it actually affects engine behaviour.  However, I see this on Snort 2.9.7.3 and also now on Snort 2.9.7.5, as well as previous versions.
>
> Thanks.
>
> -Mike Cox
>
>
>
> ------------------------------------------------------------------------------
>
>
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20150728/954e08cc/attachment.html>


More information about the Snort-devel mailing list