[Snort-users] Re: (Snort-users) Disabling rules without touching the origi

Marcus Spading linuxnews at ...4432...
Wed Jan 2 23:45:05 EST 2002


* sandro.poppi at ...3316... <sandro.poppi at ...3316...> [020103 07:36]:
> did you already try using pass rules? This helped me (and of course a lot of
> others too ;). Adding the command line option -o is then required. For your

Yes I already tried that one. It seemed to work, but ...

> For more information take a look on the excellent snort manual.

.. after reading the manual a third time, I decided it is safer not to use
the -o option, especially because I am relativly new to snort and I don't
want a bad crafted pass rule to throw away important alerts that otherwise
would have been logged.

-- 
BCNU
Marcus




More information about the Snort-users mailing list