[Snort-sigs] Reporting multiple signatures for same packet?

Chris Green cmg at ...435...
Fri Apr 26 20:56:04 EDT 2002

Glenn Larsson <ichinin at ...561...> writes:

> Problem:
> When snort recieve "\virtualroot\exploit" the first rule takes
> precedence, get's logged and the second signature get dropped.
> The only way to get "exploit" logged is to change the order, but like
> with the other order, the second signature is ignored/dropped.
> Anyone have a solution for this?

Not currently. First match exit strategy.
Chris Green <cmg at ...435...>
A watched process never cores.

More information about the Snort-sigs mailing list