[Snort-sigs] from_client == to_server ?
mkettler at ...189...
Fri Nov 28 11:08:03 EST 2003
At 09:05 AM 11/28/2003, Martin Olsson wrote:
>Are the flow keywords "from_client" and "to_server" the same thing, or is
>there any difference?
same thing.. the choice between the two is more stylistic than anything
else... ie: to focus the readers attention on the client or the server
depending on the context of the rule..
I personally use to_server for attacks, and from_client for "signs of
infection" type rules.
More information about the Snort-sigs