[Snort-users] Snort rules touble.

Erek Adams erek at ...577...
Fri Jun 21 12:29:02 EDT 2002


On Fri, 21 Jun 2002, Slighter, Tim wrote:

> If Jason is going to go with his intended build of 1.86 and would ultimately
> have to comment out anything using "flow", if he needs to stay with that
> build, then he might want to consider downloading the latest signatures from
> activeworx as well as the policy manager and integrating those into the
> rules to ensure that he is using some of the latest signatures.  Otherwise,
> it could be advantageous to move ahead to the daily snapshot and use the
> latest rules from current.

Actually, if you grab the latest rules from snort.org, you don't have the
"flow:" keyword in them at all.



More information about the Snort-users mailing list