[Snort-sigs] general sig question

Erek Adams erek at ...95...
Tue May 27 16:13:10 EDT 2003

On Tue, 27 May 2003, Tom Arseneault wrote:

> 	Am I reading the manual wrong? This seems to be exactly what he's
> asking for (tagging is anyway)?

Kinda.  He's asking for 'fire an alert only if there is over X of this
alert.  Tagging just grabs X number of packets after the first.


Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson

More information about the Snort-sigs mailing list