[Snort-users] Snort rule action/plugin question

Matt Kettler mkettler at ...4108...
Thu Jul 11 08:48:13 EDT 2002


No, such a plugin would quickly slow snort down to the point that it would 
cause packet drops, creating a security hole.

However, there are lots of good logwatcher tools out there that do this 
kind of thing quite effectively, and without creating a weakness in snort.

See the FAQ:

http://www.snort.org/docs/faq.html#5.7

and
http://www.snort.org/docs/faq.html#5.9


Unless a task truly needs to be completed within a few milliseconds of a 
packet arriving, it's probably better done a million times better by using 
a logwatcher than a plugin.


At 09:58 AM 7/11/2002 -0500, Clint M. Sand wrote:
>Is there a snort plugin that would allow snort to send pages or text 
>messages via modem when a rule is triggered?
>
>Thanks.
>
>Clint





More information about the Snort-users mailing list