[Snort-users] simple pass rules

Erek Adams erek at ...577...
Mon May 7 18:38:23 EDT 2001


On Mon, 7 May 2001, Aaron McKinnon wrote:

> Trying to write a simple pass rule:
>
> #Pass rule for uagent (ArcServe 2000 backup agent).
> pass tcp 208.158.118.3 6051 -> 208.158.118.100 any
> pass tcp 208.158.118.150 any -> 208.158.118.100 139
>
> It seems to ignore the rules in my local.rules file... Have I written these
> rules correctly?

[...snip...]

Yes, those look just fine.

Are they not passing traffic?  If not, be sure that you are using the '-o'
command line switch.

-o         Change the rule testing order to Pass|Alert|Log

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list