[Snort-sigs] from_client == to_server ?

Matt Kettler mkettler at ...189...
Fri Nov 28 11:08:03 EST 2003

At 09:05 AM 11/28/2003, Martin Olsson wrote:
>Are the flow keywords "from_client" and "to_server" the same thing, or is
>there any difference?

same thing.. the choice between the two is more stylistic than anything 
else... ie: to focus the readers attention on the client or the server 
depending on the context of the rule..

I personally use to_server for attacks, and from_client for "signs of 
infection" type rules.

More information about the Snort-sigs mailing list