[Snort-users] Snort rule action/plugin question

Matt Kettler mkettler at ...4108...
Thu Jul 11 08:48:13 EDT 2002

No, such a plugin would quickly slow snort down to the point that it would 
cause packet drops, creating a security hole.

However, there are lots of good logwatcher tools out there that do this 
kind of thing quite effectively, and without creating a weakness in snort.

See the FAQ:



Unless a task truly needs to be completed within a few milliseconds of a 
packet arriving, it's probably better done a million times better by using 
a logwatcher than a plugin.

At 09:58 AM 7/11/2002 -0500, Clint M. Sand wrote:
>Is there a snort plugin that would allow snort to send pages or text 
>messages via modem when a rule is triggered?

More information about the Snort-users mailing list