[Snort-sigs] Some notes about today's VRT Rule release for 02/09/2012

waldo kitty wkitty42 at ...3507...
Thu Feb 9 17:49:06 EST 2012


On 2/9/2012 17:45, waldo kitty wrote:
> On 2/9/2012 17:35, Joel Esler wrote:
>>
>>
>> On Thu, Feb 9, 2012 at 5:19 PM, waldo kitty<wkitty42 at ...3507...>  wrote:
>>      what policy? i've understood most things up to here... we do not use any
>>      "policy" rules in our configuration... at least nothing specifically... i don't
>>      believe that we even include the policy.rules file(s)... so one has to ask, what
>>      policy? where can one see this policy? does this change blow things up like
>>      oinkmaster's disablesid option?
>>
>> We've had three policies in the rules for some time now in the "metadata" field.
>> "policy connectivity-ips, policy balanced-ips, and policy security-ips"
>
> yes, i've seen those but they mean nothing to me or anything i know of that we
> use with snort... i did actually go digging about and found a post by you back
> in aug 2001, on the 4th or 11th i think, where you did explain a bit of this...

erk! Aug 2011, not 2001 :?

http://seclists.org/snort/2011/q3/229





More information about the Snort-sigs mailing list