[Snort-users] Pass Rule not working?

Steve Halligan giermo at ...187...
Wed Jul 24 10:33:04 EDT 2002


>Trying to be clever, I 
>wrote a pass 
>rule in my local.rules file:
>
>pass icmp any any -> *.*.*.* any (itype: 3; icode: 13)
>
>I'm still getting errors.
>
>What'd I do wrong?
>

need a -o to make snort process pass rules first


http://www.snort.org/docs/writing_rules/chap1.html#tth_sEc1.4.3




More information about the Snort-users mailing list