[Snort-sigs] Disable a rule when another trigger

Nerijus Krukauskas nkrukauskas at ...2420...
Thu Jul 15 04:56:13 EDT 2010


On Thu, July 15, 2010 11:18, Flavian Dola wrote:
> Hi,
>
> Is there a way to tell snort to disable a specific rule when another
> rule match a packet?
>
> In fact, I have two rules that generate two different alerts on one frame.
> Ideally, I would like to have just only one alert. And I don't want to
> disable permanently one of these rules.

I guess, flowbits option is the answer.

-- 
http://nk99.org/






More information about the Snort-sigs mailing list