[Snort-sigs] porn rules

Chris Green cmg at ...435...
Tue Mar 26 08:14:11 EST 2002


"Kreimendahl, Chad J" <Chad.Kreimendahl at ...361...> writes:
>
> Should the flow on porn rules be 'to_server'?

No, they shoudln't.

> wouldn't the pr0n content be
> coming 'from_server' and is that really the same as 'to_client'?

Yes they should. 
-- 
Chris Green <cmg at ...435...>
This is my signature. There are many like it but this one is mine.





More information about the Snort-sigs mailing list