[Snort-users] rules & priority

Dragos Ruiu dr at ...381...
Mon Nov 19 12:01:24 EST 2001


Check the FAQ question 3.13 about ordering of
rules as this might be of assistance.

cheers,
--dr

On Mon, 19 Nov 2001, seb . wrote:
> <poor english>
> 
> Hi,
> 
> is there any mean to specify in wich order the rules
> are applied to the traffic ?
> 
> explanations:
> for learning purposes, we set up a server with
> snort(all rules) running on.
> but when we test it with some fake attacks(with
> sneeze), the rules matched are not thoose we were
> expected.
> 
> example:
> pop2 exploit triggers nmap scan
> 
> </poor english>
> 
> -- 
> "Peace cannot be kept by force.
>   It can only be achieved by understanding." (Albert
> Einstein)
> 
> 
> ___________________________________________________________
> Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
> Yahoo! Courrier : http://courrier.yahoo.fr
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- 
Dragos Ruiu <dr at ...50...>   dursec.com ltd. / kyx.net - we're from the future 
gpg/pgp key on file at wwwkeys.pgp.net or at http://dursec.com/drkey.asc




More information about the Snort-users mailing list