[Snort-users] -c switch

scott hutinger srh at ...2042...
Thu Jan 1 13:11:47 EST 1970


Should -c be treated a bit different?

For example, I was starting up snort (debug version)
./snort -... /usr/local/etc/rules/snort.conf
This of course made snort think the rules were not rules, since I forgot 
to use -c before it.

Possibly -f (filter) would be better instead of needing -c for the rules.
I would think the rules would be a last parameter, as they are important.

Probably people would not agree with this, but possibly a detection of 
the rules
and a verbose error that -c should be used instead of no -c.  I'm sure 
this has come
up before.  I normally don't manually start snort, so forgetting the -c 
switch caused
all sorts of problems.

scott




More information about the Snort-users mailing list