[Snort-users] simple pass rules

Erek Adams erek at ...577...
Mon May 7 18:38:23 EDT 2001

On Mon, 7 May 2001, Aaron McKinnon wrote:

> Trying to write a simple pass rule:
> #Pass rule for uagent (ArcServe 2000 backup agent).
> pass tcp 6051 -> any
> pass tcp any -> 139
> It seems to ignore the rules in my local.rules file... Have I written these
> rules correctly?


Yes, those look just fine.

Are they not passing traffic?  If not, be sure that you are using the '-o'
command line switch.

-o         Change the rule testing order to Pass|Alert|Log

Erek Adams

More information about the Snort-users mailing list