[Snort-sigs] general sig question

Erek Adams erek at ...95...
Tue May 27 16:13:10 EDT 2003


On Tue, 27 May 2003, Tom Arseneault wrote:

> 	Am I reading the manual wrong? This seems to be exactly what he's
> asking for (tagging is anyway)?

Kinda.  He's asking for 'fire an alert only if there is over X of this
alert.  Tagging just grabs X number of packets after the first.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-sigs mailing list