[Snort-sigs] general sig question
erek at ...95...
Tue May 27 16:13:10 EDT 2003
On Tue, 27 May 2003, Tom Arseneault wrote:
> Am I reading the manual wrong? This seems to be exactly what he's
> asking for (tagging is anyway)?
Kinda. He's asking for 'fire an alert only if there is over X of this
alert. Tagging just grabs X number of packets after the first.
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-sigs