[Snort-users] ROFL (me too)

Jim Forster jforster at ...176...
Wed Nov 28 08:21:03 EST 2001

Hash: SHA1

"Suck" or not, many of us prefer to see what kind of garbage is coming into 
or out of our network using them.
And agreed, that is why they are disabled by default...  Otherwise the 
number of falses generated would panic most of the new snorters out there 
thinking they were the target of some massive attack. (Kind of like the 
daily E-mails I use to get saying "www.snort.org is attacking me!")   :P

At 07:48 AM 11/28/2001, Brian wrote:
>According to Ryan Russell:
> > This is something that drives us nuts on the ARIS project.  Some of the
> > signatures will go off when discussing the signature.  So, someone
> > discusses . s c r on this list, and all of the subscribers (who all run
> > Snort, naturally) suddenly have the rule go off.
>Again, one of the reasons that virus.rules is disabled by default.
>Cause they suck.
>Save the whales.  Collect the whole set.

- -----------------------------------------------------
Jim Forster
Network Administrator
RapidNet, A Golden West Company
- -----------------------------------------------------
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>


More information about the Snort-users mailing list