[Snort-users] Just one match could cover serious attack

Alvaro Lillo alvarolillo at ...131...
Sun Aug 25 07:44:02 EDT 2002


I have seen that some packets that match more than
one rule of snort only generate one alert. This
happens because snort at the first match don`t
continue
comparing content. This could cover an attack
generating only alerts of low importance. 
 
There`s any way for give priority to some rules over
others (the idea is that snort first search for
matches in some selected rules before the others)?


__________________________________________________
Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes
http://finance.yahoo.com




More information about the Snort-users mailing list