[Snort-users] Snort rule action/plugin question
mkettler at ...4108...
Thu Jul 11 08:48:13 EDT 2002
No, such a plugin would quickly slow snort down to the point that it would
cause packet drops, creating a security hole.
However, there are lots of good logwatcher tools out there that do this
kind of thing quite effectively, and without creating a weakness in snort.
See the FAQ:
Unless a task truly needs to be completed within a few milliseconds of a
packet arriving, it's probably better done a million times better by using
a logwatcher than a plugin.
At 09:58 AM 7/11/2002 -0500, Clint M. Sand wrote:
>Is there a snort plugin that would allow snort to send pages or text
>messages via modem when a rule is triggered?
More information about the Snort-users