[Snort-users] Just one match could cover serious attack

Alvaro Lillo alvarolillo at ...131...
Sun Aug 25 07:44:02 EDT 2002

I have seen that some packets that match more than
one rule of snort only generate one alert. This
happens because snort at the first match don`t
comparing content. This could cover an attack
generating only alerts of low importance. 
There`s any way for give priority to some rules over
others (the idea is that snort first search for
matches in some selected rules before the others)?

Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes

More information about the Snort-users mailing list