[Snort-sigs] HTTP_PORTS Question

Matthew Jonkman matt at ...2436...
Wed Jul 14 05:55:24 EDT 2004


If I understand you here, you're saying the order of arguments in the 
snort.conf makes a difference? The variable would be read and the web 
rules included, then the variable changed and the web rules read again?

I thought the rules optimizer code in snort would exclude duplicate 
sid's? I take it not.

This is interesting.

Thanks Brian

Matt

Brian wrote:

> 
> var HTTP_PORTS 80
> include web-misc.rules
> include web-iis.rules
> var HTTP_PORTS 8080
> include web-misc.rules
> include web-iis.rules
> 
> -b




More information about the Snort-sigs mailing list